CVE-2026-64934: Quanovate Tech Inc. Operating As Mira / Mira Care Mira Android App

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

Affected products

Published 2026-08-11. Last modified 2026-09-01.