MEDIUM 5.3 NVD
CVE-2026-109570
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by w
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing.
References
- https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln
- https://www.vulncheck.com/advisories/fire-boltt-bsw013-through-v0-0.8-unauthenticated-ble-
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-12 via NVD.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.