Description
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
Default version status: unaffected
1.7.1.47affected
Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App
Default version status: unaffected
4.5.15.4affected