Missing Authentication Vulnerability in Herowatch Mini by About Time Technologies
CVE-2026-121816

8.7HIGH

Key Information:

Vendor

About Time Technologies

Status
Herowatch Mini
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121816?

The Herowatch Mini, developed by About Time Technologies, is subject to a missing authentication vulnerability. This allows unauthenticated remote attackers to connect to the device's ADB service. Once connected, attackers can obtain an ADB shell, granting them potential access to critical device resources and the ability to perform unauthorized operations. This poses significant risks for data integrity and user privacy.

Affected Version(s)

Herowatch Mini all

References

https://www.twcert.org.tw/tw/cp-132-11355-341da-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11356-8292a-2.html
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.