Improper Authentication Vulnerability in Fire-Boltt Smartwatch by Fire-Boltt
CVE-2026-37271

9.8CRITICAL

Key Information:

Vendor

Fire-Boltt

Status
Fire-Boltt Smartwatch FB BGS001
Vendor
CVE Published:
7 July 2026

What is CVE-2026-37271?

The Fire-Boltt Smartwatch FB BGS001, specifically firmware version MOY-JS14-2.0.4, contains a flaw in its authentication mechanism. This vulnerability permits the acceptance of GATT Write Request commands without adequate authentication or robust session validation, leading to potential exploitation. Under certain circumstances, an attacker within range can capture BLE packets and replay them from another device, activating features on the smartwatch without authorization.

References

https://github.com/EmbdCDACHyd/CVE/blob/main/CVE-2026-372...
https://github.com/EmbdCDACHyd/CVE/tree/main/CVE-2026-37271

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.