This vulnerability in Mira hormone monitor firmware v1.7.1.47 allows a remote attacker within BLE range (10–30 meters) to perform multiple unauthorized actions without authentication. The attacker can silently rebind the device to an attacker-controlled account, extract sensitive hormone measurement data in cleartext, cause denial-of-service by sending malformed or undocumented command opcodes, and passively track the user because the device uses a static random BLE address that never rotates. The CVSS 4.0 score is 8.7, indicating high severity. No official patch or remediation level has been published by the vendor as of the data provided.

An attacker can gain unauthorized access to sensitive health data (hormone measurements), disrupt device functionality causing denial-of-service, and track the user’s physical location or movements via BLE address tracking. These impacts compromise user privacy, device availability, and data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit BLE exposure by disabling Bluetooth when not in use and avoid using the device in untrusted environments. Monitor vendor communications for updates on official patches or mitigations.