一、 漏洞 CVE-2026-0842 基础信息

                                        # Flycatcher smART Sketcher 蓝牙漏洞

## 概述
Flycatcher Toys smART Sketcher 版本 2.0 及之前存在安全缺陷，影响蓝牙低功耗（BLE）接口组件，导致认证缺失。

## 影响版本
Flycatcher Toys smART Sketcher ≤ 2.0

## 细节
该漏洞存在于蓝牙低功耗接口组件中，具体触发位置未知。攻击者可利用此缺陷绕过认证机制，实现未授权访问。攻击需在本地网络范围内进行。相关漏洞利用代码已被公开，具备实际利用风险。

## 影响
造成认证绕过，可能导致设备被未授权控制。由于厂商未回应漏洞披露，当前无修复措施。
                                        

二、漏洞 CVE-2026-0842 的公开POC

三、漏洞 CVE-2026-0842 的情报信息

• 标题： smart-sketcher-upload/smartsketch-upload.py at main · davidrxchester/smart-sketcher-upload · GitHub -- 🔗来源链接

  标签：exploit

  神龙速读：

                                          ### 关键信息提取
  
  #### 漏洞摘要
  这个 GitHub 项目是一个 Python 脚本（`smartsketch-upload.py`），用于将 PNG 或 JPG 图像上传到 Smart Sketch 投影仪。关键信息如下：
  
  1. **Unauthenticated Image Upload**
     - The script allows uploading images to a Smart Sketch projector without authentication.
  
  2. **Bluetooth Communication Details**
     - Uses specific UUIDs (`SERVICE_UUID` and `CHAR_UUID`) for Bluetooth communication.
     - SERVICE_UUID = "0000ffe0-0000-1000-8000-00805f9b34fb"
     - CHAR_UUID = "0000ffe3-0000-1000-8000-00805f9b34fb"
  
  3. **Image Processing**
     - The script resizes images to fit the device's display dimensions (`DEVICE_WIDTH`, `DEVICE_HEIGHT`).
     - Converts images to RGB565 format for device compatibility.
  
  4. **Chunked Data Transmission**
     - Splits image data into chunks for transmission.
     - Handles chunk size and reverses image bytes.
  
  5. **Device Compatibility**
     - Compatibility with Smart Sketch 2.0 device.
  
  ### Potential Security Implications
  - **Lack of Authentication**: The script uploads images without authentication, which could be exploited to inject arbitrary images.
  - ** rely on UUIDs**: Potential for UUID spoofing or interception.
  - **No Input Validation**: No checks for malicious image files or payload injection.
                                          

  
• https://vuldb.com/?ctiid.340442signaturepermissions-required

• 标题： CVE-2026-0842 Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication (CNNVD-202601-1794) -- 🔗来源链接

  标签：vdb-entry

  神龙速读：

                                          ## 关键漏洞信息
  
  - **CVE编号**: CVE-2026-0842
  - **风险等级**: critical
  
  ### 漏洞概述
  
  - **受影响产品**: FLYCATCHER Toys smART Sketcher up to 2.0
  - **漏洞类型**: Missing authentication
  - **组件**: Bluetooth Low Energy Interface
  
  ### 漏洞细节
  
  - **漏洞描述**: 由于蓝牙低功耗接口的未知代码中缺少认证功能，导致出现未认证漏洞问题。
  - **受影响对象**: 该漏洞影响的组件数据通信需要有效的用户身份或消耗大量资源。
  - **安全影响**: confidentiality, integrity, availability
  
  ### 开发者咨询
  
  - **修复建议**: 目前没有对策信息，建议替换受影响对象与替代产品。
  - **危害分级**: 
    - **CVSS v4**: meta base score: 6.3 meta temp score: 6.0
    - **base score**: 6.3 temp score: 5.7
    - **Vector**: directly related to the Bluetooth Low Energy Interface.
    - **Reliability**: confirmation uncertainty
  
  ### 利用信息
  - **可用性**: online
  - **访问类型**: public
  - **状态**: proof-of-concept available
  - **编程语言**: code included
  - **依赖下载**: download available
  - **EPSS Score**: high
  - **市场报价**: trend analysis available
  - **0-Day**: not currently affecting 
  
  ### 威胁情报
  - **兴趣**: minimal interest globally
  - **活跃者**: no substantial activity noted
  - **APT组织**: not associated with known APTs
  
  ### 计时
  - **发现日期**: 2026.01.10 (advisory disclosed)
  - **最后更新**: 2023.12.01 (VulDB entry last update)
  
  ### 来源
  - **公告源**: a gist hosted on github.com
  - **相关CVEs**: CVE-2026-0842
  - **认可**: VulDB Knowledge Base Servers partially sponsor this research.
                                          

  

• 标题： Submit #729134: Flycatcher Toys smART Sketcher 2.0 0/1/2 Missing Authentication for Critical Function -- 🔗来源链接

  标签：third-party-advisory

  神龙速读：

                                          ### 关键信息
  
  - **Title**: Flycatcher Toys smART Sketcher 2.0 0/1/2 Missing Authentication for Critical Function
  - **Description**: 
    - The smART Sketcher 2.0 device lacks authentication on its Bluetooth Low Energy interface.
    - This allows an unauthenticated attacker to connect, upload arbitrary images, and control device functions.
    - Affects all versions of the toy.
  - **Source User**: davidrochester (UID 94063)
  - **Submission Date**: 01/01/2026 10:08 PM (18 days ago)
  - **Moderation Date**: 01/10/2026 10:53 AM (9 days later)
  - **Status**: Accepted
  - **VulDB Entry**: 340442
  - **Points**: 20
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2026-0842

四、漏洞 CVE-2026-0842 的评论