Description

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-11T22:18:54.733Z",
  "pubdate": "2026-08-11T22:18:54.733Z",
  "executiveSummary": "The Mira Android companion app version v4.5.15.4 suffers from an insecure Bluetooth Low Energy (BLE) peripheral identification and authentication vulnerability. The vulnerability type is lack of cryptographic authentication and improper input validation during peripheral discovery, leading to spoofing and data injection.\nThe impact allows an unauthorized attacker to capture live session token information and inject forged hormone measurements directly into the victim's cloud record and clinical trend view, compromising the integrity of medical data.\nThe affected system is the Mira Android companion app version v4.5.15.4, which interfaces with the Mira hormone analyzer.\nThe risk implications are severe, as corrupted clinical trends and unauthorized cloud record modifications can lead to misdiagnosis, improper clinical evaluation, and compromised patient safety.\nAttacker capabilities include the ability to passively sniff or actively intercept BLE communications, spoof legitimate peripheral broadcast names, and forge arbitrary physiological telemetry payloads.\nExploitation requirements include proximity to the target device during the BLE advertisement and connection phase, alongside the capacity to execute BLE scanning and injection attacks.",
  "technicalDetails": "The root cause of this vulnerability lies in the application's peripheral identification logic within the Mira Android companion app version v4.5.15.4. Specifically, the software determines the identity of the paired Mira hormone analyzer by executing a simplistic substring match against the BLE advertisement name alone.\nThe vulnerable component is the BLE discovery and connection management module within the mobile application. This module completely lacks cryptographic peripheral authentication, hardware MAC address allowlisting, and secure bonded-identity verification protocols.\nBecause the application relies exclusively on unauthenticated broadcast strings (BLE advertisement names) to establish trust and communication channels with the hardware sensor, it becomes trivial for an adversary to spoof the broadcasted name of a legitimate hormone analyzer.\nThe attack flow proceeds as follows: First, an attacker monitors the local radio frequency environment to observe BLE advertisement packets emitted during device pairing or synchronization. Second, the attacker captures live session token information transiting the unauthenticated or inadequately protected medium. Third, utilizing the captured session context and the substring-matching flaw, the attacker broadcasts a forged BLE advertisement emulating the Mira hormone analyzer. Fourth, upon successful connection by the victim's Android application, the attacker injects malicious, forged hormone measurements into the data pipeline. Finally, the application ingests this fabricated telemetry and synchronizes it with the remote backend, corrupting the victim's cloud record and altering the clinical trend view presented to healthcare providers.\nThe authentication requirements are absent for the BLE peripheral layer, allowing any unauthenticated device mimicking the broadcast criteria to interface with the application. The privilege requirements are low, requiring no prior access to the mobile device itself, but necessitating physical or radio proximity to exploit the local wireless interface. The network exposure is restricted to the local BLE spectrum surrounding the victim.\nThe post-exploitation impact includes unauthorized data modification, injection of false clinical metrics into cloud infrastructure, potential exposure of session tokens, and total compromise of the data integrity lifecycle for the affected user's hormone tracking telemetry."
}