Fire-Boltt BSW013 vulnerabilities

2 CVEs affecting Fire-Boltt BSW013, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-109571, published 2026-10-12.

More from Fire-Boltt.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-109571, published 2026-10-12. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to the Heart Rate Measurement characteristic…
• CVE-2026-109570, published 2026-10-12. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command…