What is GHSA-hj6p-cc45-4m6g?

GHSA-hj6p-cc45-4m6g is a security advisory published by GitHub Security Advisories with Low severity. Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication...

Which CVE IDs does GHSA-hj6p-cc45-4m6g cover?

GHSA-hj6p-cc45-4m6g covers the following CVE IDs: CVE-2026-109571. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hj6p-cc45-4m6g?

GHSA-hj6p-cc45-4m6g has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-hj6p-cc45-4m6gLowCVSS 4.3

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-109571 →

📋 Description

Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic (0x2A37). Attackers within Bluetooth range can receive the wearer's live heart rate readings without pairing, bonding, or any confirmation on the watch.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-109571
https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln
https://www.vulncheck.com/advisories/fire-boltt-bsw013-firmware-through-v0-0.8-unauthenticated-heart-rate-disclosure-via-ble
https://github.com/advisories/GHSA-hj6p-cc45-4m6g