CVE-2026-109571 Fire-Boltt CVE debrief

Who should care

Defenders responsible for managing and securing Fire-Boltt BSW013 smartwatches should assess exposure and prioritize remediation to prevent potential breaches. This includes verifying the vulnerability, assessing the potential impact, and implementing additional security measures to mitigate risks. Defenders should also review and update security policies and procedures to prevent similar vulnerabilities in the future.

Why it matters

CVE-2026-109571 allows unauthenticated access to heart rate data from Fire-Boltt BSW013 smartwatches via BLE, requiring defenders to verify and remediate affected devices.

• Potential unauthorized disclosure of heart rate data
• Increased risk of privacy breaches
• Need for verification of affected devices and remediation

Technical summary

The Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). This vulnerability has a CVSS score of 2.3 and is considered low severity. The vulnerability requires verification of affected devices and remediation to mitigate risks. The vulnerability affects the Heart Rate Measurement characteristic (0x2A37) and requires defenders to assess exposure and prioritize remediation.

Defensive priority

Defenders should prioritize verifying and remediating affected Fire-Boltt BSW013 smartwatches.

Recommended defensive actions

• Verify and remediate affected Fire-Boltt BSW013 smartwatches
• Monitor for potential unauthorized access to heart rate data
• Implement additional security measures for BLE communications
• Conduct a thorough review of the vulnerability and its potential impact on the organization
• Develop a plan to remediate affected devices and mitigate potential risks
• Assign an owner to track the vulnerability and ensure remediation
• Review and update security policies and procedures to prevent similar vulnerabilities in the future

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on affected users and potential impact is limited. Defenders should verify the vulnerability and assess exposure to prevent potential breaches. The source item and CVE record provide evidence of the vulnerability, but further research is needed to determine the full scope of affected devices and potential impact. The vulnerability allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37), potentially dis

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.