Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Fire-Boltt BSW013 smartwatch may leak heart rate data

CVE-2026-109571 · published 6 days ago
Summary

The smartwatch firmware up to version 0.0.8 lets nearby Bluetooth devices read the wearer’s heart‑rate without any pairing or approval. Someone standing close could see live health information, which could be a privacy concern. Update the watch to the latest firmware or disable Bluetooth when not needed to stop the exposure.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
fire-boltt bsw013 <= V0.0.8
Original advisory text
Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published12 Oct 2026
Updated16 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109571 · NVD
CVE-2026-109571 · MITRE
Track software like this
Free during beta