Description

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T22:18:54.587Z",
  "pubdate": "2026-08-11T22:18:54.587Z",
  "executiveSummary": "A series of critical security vulnerabilities has been identified in the Mira hormone monitor device firmware v1.7.1.47 build 01070147, allowing unauthenticated remote attackers within Bluetooth Low Energy (BLE) range to compromise user privacy and device integrity.\nThe identified flaws encompass insecure device rebinding, cleartext storage and transmission of sensitive physiological measurements, denial-of-service susceptibility via malformed command opcodes, and continuous user tracking through static non-rotating BLE MAC addresses.\nThe impact includes total loss of confidentiality regarding personal health data, unauthorized device hijacking, persistent user tracking, and availability disruptions.\nAn attacker requires physical proximity within the standard BLE range of approximately 10 to 30 meters and needs no prior authentication or administrative privileges to successfully exploit these weaknesses.\nThe risk implications are severe due to the sensitive nature of the exposed health metrics and the potential for malicious disruption of medical tracking devices.",
  "technicalDetails": "The vulnerabilities reside within the BLE communication stack and firmware logic of the Mira hormone monitor device firmware v1.7.1.47 build 01070147.\nThe root cause of the unauthorized rebinding vulnerability stems from an absence of cryptographic authentication and authorization checks during the device pairing and binding routines, enabling any unauthenticated peripheral observer to issue binding commands and overwrite the legitimate account association.\nData confidentiality is compromised due to the storage and retrieval of sensitive hormone measurements in cleartext, lacking proper encryption at rest or in transit over the BLE interface.\nThe denial-of-service vector is introduced via insufficient input validation within the command opcode parser, allowing malformed or undocumented command opcodes to crash the firmware execution flow or hang the device state machine.\nFurthermore, the device violates privacy best practices by utilizing a static random BLE address that fails to rotate periodically, directly facilitating passive tracking of the device and its bearer over time.\nThe attack flow proceeds as follows: First, the attacker uses standard BLE scanning tools within the 10 to 30-meter range to identify the target device by observing its static random BLE address. Second, the attacker transmits arbitrary or undocumented malformed command opcodes to induce a denial-of-service condition or initiates an unauthorized rebinding command sequence to force the device to associate with an attacker-controlled account. Third, once bound or by leveraging existing cleartext data exposure characteristics, the attacker intercepts or queries the device memory to exfiltrate stored hormone measurements in cleartext without user consent."
}