Quanovate Mira Monitor Hardcoded Auth/Weak Auth Multiple CVEs (ICSMA-26-223-01)

Vulnerability Overview Vulnerability Name: Mira Hormone Monitor, Mira Android App Release Date: August 11, 2026 Alert Code: ICSMA-26-223-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Affected Products Affected Versions: - Mira Monitor Firmware 1.7.17 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832) - Mira Android App 4.5.15.4 (CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934, CVE-2026-66832) CVSS Score: v3 9.8 Vendor: Quanovate Tech Inc. (operating as Mira / Mira Care) Device: Mira Hormone Monitor, Mira Android App Vulnerability Types: - Critical Functionality Lacks Authentication - Authentication Bypass via Spoofing - Use of Hardcoded Credentials - Weak Authentication - Improper Rate Limiting for Authentication Attempts - Reliance on Unverified Input for Security Decisions - Use of GET Request Method with Sensitive Query String Remediation Recommended Practices: - Minimize network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet. - Place control system networks and remote devices behind firewalls and isolate them from the business network. - When remote access is required, use more secure remote access methods such as Virtual Private Networks (VPN), recognizing that VPNs may have vulnerabilities and should be updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures to report suspicious malicious activity and report findings to CISA to facilitate tracking and correlation of other incidents. - Do not click links in unsolicited emails or open attachments. - Refer to "Identifying and Avoiding Email Scams" for more information. - Refer to "Avoiding Social Engineering and Phishing Attacks" for more information. Vulnerability List CVE-2026-66875 CVE-2026-66098 CVE-2026-67558 CVE-2026-67568 CVE-2026-68067 CVE-2026-66340 CVE-2026-64934 CVE-2026-66832 Acknowledgments The Northeast University SPQR Laboratory, including Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong, reported these vulnerabilities to Quanovate Tech. Legal Notice and Terms of Use This product is subject to this notice and the privacy and usage policy. Revision History Initial Release Date: 2026-08-11 Revision: 1 Summary: Initial Release Tags Industry: Healthcare and Public Health Industry Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Advisories PulseTo Vagus Nerve Stimulator (ICSMA-26-223-02) Medixant RadiAnt DICOM (ICSMA-26-218-01) Thermo Fisher Applied Biosystems Genetic Analyzers (ICSMA-26-216-01) OFFIS DCMTK Toolkit (ICSMA-26-181-01) Feedback Please share your thoughts. We have recently updated our anonymous product survey; feedback is welcome. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security About CISA: Budget and Performance, DHS.gov, FOIA Requests, No-FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback Summary This page details multiple security vulnerabilities in the Mira Hormone Monitor and Mira Android App, including critical functionality lacking authentication, authentication bypass via spoofing, and the use of hardcoded credentials. The affected versions are Mira Monitor Firmware 1.7.17 and Mira Android App 4.5.15.4. CISA provides detailed remediation recommendations and best practices to minimize the risk associated with these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Quanovate Mira Monitor Hardcoded Auth/Weak Auth Multiple CVEs (ICSMA-26-223-01)

More from this source