Loading story…
CISA-linked disclosures detailed serious vulnerabilities in two consumer health-device ecosystems: Quanovate Tech's Mira Hormone Monitor and Pulsetto Vagus Nerve Stimulator. In Mira, researchers identified 20 issues, including CVE-2026-67568 and CVE-2026-66875, affecting firmware 1.7.1.47 and Android app 4.5.15.4. The flaws include hard-coded credentials that could expose reproductive health profiles over internet-connected hosts, and missing authentication over Bluetooth Low Energy that could let a nearby attacker silently rebind a device to an attacker-controlled account, read hormone measurements in cleartext, trigger denial of service, and track users via a static BLE address. The reported impact includes theft, forgery, deletion, or destruction of sensitive fertility data, with potential disruption to treatment decisions.
Pulsetto's firmware was separately assigned CVE-2026-18844 for hidden BLE functionality that accepts undocumented commands without authentication or encryption whenever the device is powered on. The issue could allow an adjacent attacker to alter stimulation settings or disable electrical safety mechanisms, creating high integrity and availability risk. Quanovate released remediations including firmware 01.07.01.53 and Android app 4.5.18 for Mira, while CISA said Pulsetto had not responded to outreach and advised users to contact the vendor for remediation details. No evidence of active exploitation was reported for the Mira issues, and CISA's SSVC data for Pulsetto listed exploitation as none.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
CISA added SSVC decision data for CVE-2026-18844, marking exploitation as none, automatable as no, and technical impact as partial. References were also added to a CISA medical advisory and a CSAF record.
CISA received CVE-2026-66875 affecting Mira firmware 1.7.1.47 and Android app 4.5.15.4. The flaw allows unauthenticated attackers within BLE range to rebind devices, extract measurements, trigger denial of service, and track users.
CISA received CVE-2026-67568 covering Mira Firmware 1.7.1.47 and Mira Android App 4.5.15.4. The vulnerability allows read and write access to reproductive health profiles from internet-connected hosts.
The CVE record for CVE-2026-18844, affecting the Pulsetto Vagus Nerve Stimulator firmware, was received by ics-cert@hq.dhs.gov. The issue involves undocumented BLE commands accepted without authentication or encryption.
A public report described critical vulnerabilities in the Mira Hormone Monitor ecosystem and the Pulsetto Vagus Nerve Stimulator. It noted no evidence of actual or attempted exploitation of the Mira vulnerabilities and said Pulsetto had not responded to CISA outreach.
Quanovate Tech released remediation updates for Mira, including firmware version 01.07.01.53, Android app version 4.5.18, and iOS app version 3.5.18. These updates addressed vulnerabilities affecting firmware 1.7.1.47 and Android app 4.5.15.4.
HIPAA Journal reported that Northeastern University SPQR Lab identified 20 vulnerabilities in the Mira hormone monitor ecosystem and coordinated disclosure with Quanovate Tech and CISA. Quanovate Tech completed two rounds of remediation before the findings were previewed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Severe vulnerabilities in Meari Technology’s white-label IoT platform exposed more than 1 million baby monitors and security cameras across 118 countries, affecting devices sold under hundreds of brands on marketplaces including Amazon. Researcher Sammy Azdoufal reported that weaknesses in Meari’s hardware, mobile apps, SDKs, cloud services, and backend infrastructure allowed unauthorized access to MQTT message streams, device data, user email addresses, rough location information, WAN IP addresses, and real-time camera activity. Publicly accessible motion-alert images stored on Alibaba OSS and missing per-device access controls on Meari’s EMQX-based IoT platform left sensitive household photos and notifications exposed, raising particular concern for devices deployed in bedrooms, nurseries, and other private spaces. Meari acknowledged that attackers could intercept messages without authorization and disclosed a potential remote code execution risk linked to weak passwords on a scheduled task platform. The company said it shut down the exposed EMQX platform, changed credentials, and advised firmware upgrades for devices running versions below `3.0.0`, while Azdoufal said five CVEs were coordinated with runZero and CISA under `VU#579666`. A published disclosure timeline alleges Meari delayed responding, minimized some findings, used backdated advisories that covered only part of the issues, and failed to directly notify affected EU users or confirm GDPR breach reporting; Azdoufal later received a €24,000 bug bounty after an agreement preserved his right to publish the findings.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding multiple high-severity vulnerabilities in the BioDose/NMIS software, a nuclear medicine inventory tracking solution developed by EC2 Software and owned by Mirion Medical. These vulnerabilities, present in versions prior to 23.0, could allow attackers to modify program executables, execute code remotely, and access sensitive information if exploited. The software is widely used in nuclear medicine and radiology departments, raising concerns about the potential impact on healthcare operations and data security. Mirion Medical has confirmed that the identified flaws have been addressed in the latest release of the software. The company stated that it acted promptly upon learning of the vulnerabilities, working in coordination with CISA and its customers to deliver fixes and mitigate risk. Organizations using affected versions are strongly advised to update to the latest release to ensure protection against these critical security issues.
Jun 29, 2026
A security flaw in **DJI Romo** robot vacuums allowed unauthorized access to thousands of devices after a user reverse-engineered the device-to-cloud protocol to build a custom controller app. By obtaining the private token for their own vacuum, the researcher reported they could access backend servers across regions and inadvertently gained control of roughly **6,700** vacuums, with potential access to **floor plans**, **live camera/microphone feeds**, and remote control functions; DJI issued server-side/firmware updates that required no user action, though the researcher reported at least two issues remained (including video streaming without a PIN and another undisclosed high-severity problem). Separately, mobile security researchers reported that popular **Android mental health apps** (about **14.7M installs** across ten apps) contained **1,575** vulnerabilities—mostly low/medium severity but including **54 high-severity** findings—creating risk of exposure of sensitive therapy data via issues such as credential interception, notification spoofing, HTML injection, and user location leakage. Optimizely also confirmed a **data breach** following a **vishing (voice-phishing)** attack that provided attackers access to some internal systems and resulted in theft of **basic business contact information** from internal business systems/CRM and limited back-office documents; the company said attackers could not escalate privileges, install software, or establish backdoors, and it reported no evidence of access to sensitive customer data beyond contact details. While the Optimizely incident is distinct from the consumer-device and mobile-app vulnerability disclosures, it reinforces the operational risk of **social engineering** and the likelihood of follow-on phishing using stolen contact data.
Jun 29, 2026