Machine-generated analysis · WAYSCloud LLM
Mira Hormone Monitor firmware 1.7.1.47 and Mira Android App 4.5.15.4 are vulnerable to eight CVEs, including remote BLE authentication bypass.
Context
The affected products are Mira Hormone Monitor firmware version 1.7.1.47 and Mira Android App version 4.5.15.4 from Quanovate Tech Inc. The advisory states that a remote unauthenticated attacker within BLE range can silently rebind the device to an attacker-controlled account, extract cleartext hormone measurements, cause denial-of-service, and track the user via a static random BLE address that never rotates. The BLE range is described as approximately 10–30 meters.
Operator considerations
Check: Verify device firmware and app versions against 1.7.1.47 and 4.5.15.4.
Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user accounts.
Read the full advisory on CISA →