Mira fertility devices and Pulsetto stimulator exposed critical BLE and credential flaws

CISA-linked disclosures detailed serious vulnerabilities in two consumer health-device ecosystems: Quanovate Tech's Mira Hormone Monitor and Pulsetto Vagus Nerve Stimulator. In Mira, researchers identified 20 issues, including CVE-2026-67568 and CVE-2026-66875, affecting firmware 1.7.1.47 and Android app 4.5.15.4. The flaws include hard-coded credentials that could expose reproductive health profiles over internet-connected hosts, and missing authentication over Bluetooth Low Energy that could let a nearby attacker silently rebind a device to an attacker-controlled account, read hormone measurements in cleartext, trigger denial of service, and track users via a static BLE address. The reported impact includes theft, forgery, deletion, or destruction of sensitive fertility data, with potential disruption to treatment decisions.

Pulsetto's firmware was separately assigned CVE-2026-18844 for hidden BLE functionality that accepts undocumented commands without authentication or encryption whenever the device is powered on. The issue could allow an adjacent attacker to alter stimulation settings or disable electrical safety mechanisms, creating high integrity and availability risk. Quanovate released remediations including firmware 01.07.01.53 and Android app 4.5.18 for Mira, while CISA said Pulsetto had not responded to outreach and advised users to contact the vendor for remediation details. No evidence of active exploitation was reported for the Mira issues, and CISA's SSVC data for Pulsetto listed exploitation as none.