CVE-2026-67558CWE-290

CVE-2026-67558

High · published August 12, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-08-12T02:18Z
References (2)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json · [email protected]https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 · [email protected]
EPSS history
Timeline
  • 11 AUG 21:27Z
    Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
    cvelistv5