The Mira cloud API accepts the firmware version reported by the companion app as authoritative without independent attestation from the device itself. This design flaw (CWE-807: Reliance on Untrusted Inputs in a Security Decision) enables an authenticated attacker to submit arbitrary firmware version strings for their own device. Consequently, the attacker can evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics. The vulnerability affects Mira Firmware version 1.7.1.47. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An authenticated attacker can manipulate the reported firmware version of their device, causing the vendor to have inaccurate data about device patch status. This can lead to evasion of vulnerable-fleet analytics, suppression of security update prompts to the user, and inaccurate patch adoption metrics. This undermines the integrity of security monitoring and update enforcement but does not directly enable remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be aware of the potential for inaccurate firmware version reporting and consider this when evaluating device security posture. No official fix or temporary workaround has been published at this time.