CVE-2026-109570 Fire-Boltt CVE debrief

Who should care

Defenders responsible for managing and securing Fire-Boltt BSW013 smartwatches, as well as those concerned with phishing attacks and Bluetooth security, should verify affected devices, assess upgrade feasibility, and implement additional security measures to prevent phishing attacks. This includes verifying affected Fire-Boltt BSW013 smartwatches are within Bluetooth range of potential attackers, assessing the feasibility of upgrading to a patched version,

Why it matters

CVE-2026-109570 is a medium-severity vulnerability in Fire-Boltt BSW013 smartwatches that allows unauthenticated BLE notification injection, potentially enabling phishing attacks. Defenders should verify affected devices, assess upgrade feasibility, and implement additional security measures to prevent phishing attacks.

• Potential phishing attacks through spoofed alert text
• Unauthenticated notification injection within Bluetooth range
• Verification of affected versions and potential upgrade paths required
• Limited information available on potential exploits or victim impact

Technical summary

The Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing. The vulnerability has a CVSS score of 5.3 and a MEDIUM severity rating. Defenders should verify affected devices, assess upgrade feasibility, and implement additional security measures to prevent phishing attacks.

Defensive priority

Medium priority for verification and mitigation due to potential phishing risks

Recommended defensive actions

• Verify the affected Fire-Boltt BSW013 smartwatches are within Bluetooth range of potential attackers
• Assess the feasibility of upgrading to a patched version or applying compensating controls
• Monitor for suspicious notification activity
• Implement additional security measures to prevent phishing attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploits or victim impact. Defenders should verify affected Fire-Boltt BSW013 smartwatches, assess the feasibility of upgrading to a patched version or applying compensating controls, and implement additional security measures to prevent phishing attacks. The vulnerability allows unauthenticated BLE notification injection within Bluetooth range, potentially enabling phishing attacks through spoofed alert text.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.