CVE-2026-66875: falha de alta gravidade em Quanovate Tech Inc. (operating as Mira / Mira…
Mira Hormone Monitor, Mira Android App Missing authentication for critical function
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Quanovate Tech Inc. (operating as Mira / Mira Care) · Mira Android AppQuanovate Tech Inc. (operating as Mira / Mira Care) · Mira FirmwareCVEs relacionadas — Quanovate Tech Inc. (operating as Mira / Mira…
No mesmo produto, das mais perigosas para as menos.
CVE-2026-68067CRITICALMira Hormone Monitor, Mira Android App Weak AuthenticationEPSS 0.5%CVE-2026-67568CRITICALMira Hormone Monitor, Mira Android App Use of Hard-coded CredentialsEPSS 0.4%CVE-2026-66340MEDIUMMira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attemptsEPSS 0.4%CVE-2026-66832MEDIUMMira Hormone Monitor, Mira Android App Use of GET request method with sensitive query stringsEPSS 0.4%CVE-2026-66098HIGHMira Hormone Monitor, Mira Android App Missing authentication for critical functionEPSS 0.3%CVE-2026-64934MEDIUMMira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decisionEPSS 0.3%