CVE-2026-121818— About Time Technologies｜Herowatch Go - Security Misconfiguration

Quick assessment

Affected

About Time Technologies Herowatch Go

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

由 About Time Technologies 开发的 Herowatch Mini 存在系统签名漏洞。已认证的本地攻击者可利用公开可用的测试密钥对恶意程序进行签名，从而提升权限并执行任意代码。

CVSS 7.8 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

About Time Technologies｜Herowatch Go - Security Misconfiguration

Source: CVE Program / CVE List V5

Vulnerability Description

Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1394

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
About Time Technologies	Herowatch Go	all	-

II. Public POCs for CVE-2026-121818

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121818

请登录查看更多情报信息。

Other References for CVE-2026-121818 (2)

https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html third-party-advisory
https://www.twcert.org.tw/en/cp-139-11362-1e829-2.html third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121818

Same Patch Batch · About Time Technologies · 2026-11-04 · 3 CVEs total

CVE-2026-121816	8.8 HIGH	About Time Technologies｜Herowatch Mini - Missing Authentication
CVE-2026-121817	7.5 HIGH	About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference

IV. Related Vulnerabilities

Same vendor: About Time Technologies

Same weakness: CWE-1394