CVE-2026-67558: Quanovate Tech Inc. (operating as Mira / Mira Care)

Описание

Оригинално описание

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

Засегнати продукти

• Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware: 1.7.1.47
• Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App: 4.5.15.4

Вид слабост

• CWE-290 Заобикаляне на автентикация чрез подправяне

История

Други уязвимости в Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware

• 8.8CVE-2026-66875
• 7.1CVE-2026-66098
• 9.3CVE-2026-67568
• 9.8CVE-2026-68067
• 6.9CVE-2026-66340

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-67558
• https://nvd.nist.gov/vuln/detail/CVE-2026-67558
• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json