Vulnerabilidad · Publicado 11/08/2026
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Score: 7.4/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CWE-290
Publicado en NIST NVD.