CVE-2026-37271
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Fire-Boltt Smartwatch FB BGS001 with firmware MOY-JS14-2.0.4 has an improper authentication vulnerability. The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.
Risk Assessment
An attacker within Bluetooth range could take control of smartwatch functions, such as displaying notifications or controlling settings, without the user's knowledge. This could lead to privacy breaches or unauthorized actions on the device.
Recommendation
Immediately update the smartwatch firmware to the latest version if a patch is available from the vendor. In the meantime, disable Bluetooth when not in use and avoid pairing in untrusted locations.
Original NVD description (English source)
Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.