CVE-2026-64934— Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
Quick assessment
Affected
Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Quanovate Mira Firmware是Quanovate公司的一款智能生育健康监测设备的固件。 Quanovate Mira Firmware 1.7.1.47版本和Mira Android App 4.5.15.4版本存在输入验证错误漏洞，该漏洞源于Mira云API接受配套应用报告的固件版本作为权威版本而未独立验证设备版本，可能导致经过身份验证的攻击者提交任意固件版本字符串，逃避厂商端漏洞舰队分析、抑制安全更新提示并误报补丁采用指标。
Possible ATT&CK Techniques 2 AI
T1140 · Deobfuscate/Decode Files or Information T1078 · Valid AccountsAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 |
affected |
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-64934
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision
Source: CVE Program / CVE List V5
Vulnerability Description
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在安全决策中依赖未经信任的输入
Source: CVE Program / CVE List V5
Vulnerability Title
Quanovate Mira Firmware 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Quanovate Mira Firmware是Quanovate公司的一款智能生育健康监测设备的固件。 Quanovate Mira Firmware 1.7.1.47版本和Mira Android App 4.5.15.4版本存在输入验证错误漏洞，该漏洞源于Mira云API接受配套应用报告的固件版本作为权威版本而未独立验证设备版本，可能导致经过身份验证的攻击者提交任意固件版本字符串，逃避厂商端漏洞舰队分析、抑制安全更新提示并误报补丁采用指标。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware | 1.7.1.47 | - |
|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App | 4.5.15.4 | - |
|
II. Public POCs for CVE-2026-64934
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64934
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-64934 (2)
Same Patch Batch · Quanovate Tech Inc. (operating as Mira / Mira Care) · 2026-08-11 · 8 CVEs total
| CVE-2026-68067 | 9.8 CRITICAL | Mira Hormone Monitor, Mira Android App Weak Authentication |
| CVE-2026-67568 | 9.1 CRITICAL | Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials |
| CVE-2026-66875 | 8.8 HIGH | Mira Hormone Monitor, Mira Android App Missing authentication for critical function |
| CVE-2026-67558 | 7.4 HIGH | Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing |
| CVE-2026-66832 | 6.5 MEDIUM | Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query stri |
| CVE-2026-66098 | 6.5 MEDIUM | Mira Hormone Monitor, Mira Android App Missing authentication for critical function |
| CVE-2026-66340 | 5.3 MEDIUM | Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication at |
IV. Related Vulnerabilities
Same product: Mira Firmware
-
CVE-2026-66875
Mira Hormone Monitor, Mira Android App Missing authenticatio -
CVE-2026-66098
Mira Hormone Monitor, Mira Android App Missing authenticatio -
CVE-2026-67558
Mira Hormone Monitor, Mira Android App Authentication bypass -
CVE-2026-67568
Mira Hormone Monitor, Mira Android App Use of Hard-coded Cre -
CVE-2026-68067
Mira Hormone Monitor, Mira Android App Weak Authentication
Same vendor: Quanovate Tech Inc. (operating as Mira / Mira Care)
-
CVE-2026-66875
Mira Hormone Monitor, Mira Android App Missing authenticatio -
CVE-2026-66098
Mira Hormone Monitor, Mira Android App Missing authenticatio -
CVE-2026-67558
Mira Hormone Monitor, Mira Android App Authentication bypass -
CVE-2026-67568
Mira Hormone Monitor, Mira Android App Use of Hard-coded Cre -
CVE-2026-68067
Mira Hormone Monitor, Mira Android App Weak Authentication
Same weakness: CWE-807
-
CVE-2026-104658
Reliance on Untrusted Inputs in a Security Decision in hMail -
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restric -
CVE-2026-103267
Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via S -
CVE-2026-102117
Kiteworks Core Remote Code Execution -
CVE-2026-101131
deepseek-ai deepseek-harness dsh index.ts reliance on untrus
V. Comments for CVE-2026-64934
No comments yet