Threat database

Fire-Boltt BSW013 smartwatch firmware versions up to 0.0.8 contain a missing authentication vulnerability that allows unpaired Bluetooth Low Energy devices to subscribe to the Heart Rate Measurement characteristic. This enables attackers within Bluetooth range to receive live heart rate data without pairing or user confirmation. The vulnerability has a low severity score and no known exploits in the wild. No patch or remediation information is currently available.

Fire-Boltt BSW013 smartwatch firmware versions up to 0.0.8 have a missing authentication vulnerability that allows unpaired attackers within Bluetooth range to inject notifications. This is possible because the proprietary BLE command characteristic accepts commands protected only by a CRC-16/ARC checksum, which does not provide authentication. Exploitation can cause the watch to vibrate and display spoofed alert text, potentially enabling phishing attacks.