Description
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 | — |
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 | — |
Advisories 1
- ICSMA-26-223-01 Mira Hormone Monitor, Mira Android App CISA ICS & IT advisories · Aug 11, 2026