CyberRota Analysis
AI-GeneratedThe Mira Android companion app version 4.5.15.4 is vulnerable due to its reliance on a simple substring match for identifying the paired hormone analyzer, lacking robust authentication mechanisms. This flaw allows attackers to intercept session tokens and inject fraudulent hormone measurements into the victim's cloud records, potentially compromising clinical data integrity. Organizations utilizing this app, particularly in healthcare settings, should prioritize remediation to safeguard patient data and maintain trust in their clinical systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.