CVE-2026-66875
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.
Risk Assessment
An attacker could take control of the medical device, steal sensitive health data, and track the user, posing a serious threat to privacy and safety.
Recommendation
Update the Mira firmware to the latest version. Limit BLE range and monitor unauthorized pairings.
Other vulnerabilities in Mira hormone monitor firmware
Original NVD description (English source)
In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS