CVE-2026-109570 — Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the pro…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7