Vulnerability in Mira Android App Affects BLE Communication Security
CVE-2026-67558
8.2HIGH
Key Information:
- Vendor
- CVE Published:
- 11 August 2026
What is CVE-2026-67558?
The Mira Android companion app version 4.5.15.4 is susceptible to a vulnerability that compromises the security of Bluetooth Low Energy (BLE) communication. This issue arises from the app's dependence on substring matching of the BLE advertisement name, lacking essential cryptographic authentication measures. As a result, attackers can sniff session tokens, allowing them to inject counterfeit hormone readings into a victim's cloud records. This manipulation can disrupt clinical trend analysis and potentially lead to harmful decisions in patient care.
Affected Version(s)
Mira Android App Android 4.5.15.4
Mira Firmware 1.7.1.47
References
CVSS V4
Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of Northeastern University SPQR Lab reported this vulnerability to Quanovate Tech.