Fire-Boltt BSW013 BLE Unauthorized Command Injection Vulnerability Analysis

Vulnerability Overview Vulnerability Name: Fire-Boltt BSW013 BLE Vulnerability Vulnerability Type: Unauthorized BLE Command Injection Affected Products: Fire-Boltt BSW013 Smartwatch, Firmware Version V0.0.8 Vulnerability Description: The Fire-Boltt BSW013 smartwatch accepts Bluetooth Low Energy (BLE) GATT write commands from any device without requiring pairing, bonding, or any form of authentication or session validation. This allows an attacker within BLE range to: 1. Inject arbitrary notification content (custom title and body text) into the watch display, accompanied by vibration alerts, without user interaction. 2. Trigger the watch's native pairing prompt from an unpaired device; if the wearer accepts this prompt, the watch discloses device identification information—device name, Bluetooth MAC address, chipset vendor, model string, and secondary hardware identifier—in plaintext via unencrypted BLE notifications. 3. Subscribe to the watch's real-time heart rate measurement characteristic from a completely unpaired and unauthenticated device, receiving real-time BPM readings during heart rate monitoring activity, without any pairing, bonding, or confirmation. Impact Scope Vulnerability Classification: - CWE-306: Missing Authentication for Critical Function (Primary) - CWE-284: Improper Access Control - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (Secondary; applies to Findings B and C) CVSS 3.1 Vector (Self-Assessed): - A — Unauthorized Notification Injection: AV:/AC:L/PR:N/UI:N/RS:U/C:N/I:L/A:L — 5.9 (Medium) - B — Pairing-Triggered Information Leakage: AV:/AC:L/PR:N/UI:R/RS:U/C:N/I:N/A:N — 4.2 (Medium) - C — Unauthorized Heart Rate Disclosure: AV:/AC:L/PR:N/UI:N/RS:U/C:H/I:N/A:N — 7.1 (High) Impact: - Notification Spoofing/Social Engineering (Finding A): An attacker can display arbitrary, seemingly legitimate notifications on the victim's wrist without interaction, approaching from any BLE range (typically 10-30 meters, more with directional antennas). This can be used for harassment, spamming, or crafting deceptive messages that the wearer might act upon. - Device Fingerprinting/Information Leakage (Finding B): An attacker who successfully social engineers the wearer into accepting a spoofed pairing prompt can obtain plaintext hardware identification data, which may facilitate further attacks or tracking. - Exposure of Sensitive Health Data (Finding C): An attacker can passively read the wearer's real-time heart rate data within BLE range without pairing, interaction, or wearer awareness, provided heart rate monitoring is active. This constitutes a privacy-sensitive exposure of personal health information and is the most severe of the three findings. - No arbitrary code execution, firmware modification, or persistent compromise was found—this research did not extend to firmware-level analysis. Remediation 1. Implement BLE pairing/bonding (e.g., LE Secure Connections) as a mandatory requirement for accepting any GATT write commands, and before allowing subscriptions to sensitive characteristics such as heart rate measurement. 2. Bind application-layer session state to the underlying BLE bonding state, ensuring that "pairing" cannot be achieved at the application layer without real BLE-level authentication. 3. Add rolling nonces, counters, or timestamp-based freshness checks to command payloads to verify on the device side, preventing replay attacks if valid commands are captured. 4. Do not transmit device identification information (MAC, chipset, model) as responses over unauthenticated or newly unpaired connections. POC Code ```python poc/finding_a_notification_injection.py import bleak import asyncio async def main(): Target watch MAC address target_mac = "XX:XX:XX:XX:XX:XX" Command packet structure command = bytes([ 0xAB, Start byte 0x01, Sub-header 0x00, 0x00, Length (2 bytes) 0x00, 0x00, Checksum (2 bytes) 0x01, Command (1 byte) 0x01, Key (1 byte) 0x00, Flag (1 byte) 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

Goal Reached Thanks to every supporter — we hit 100%!

Fire-Boltt BSW013 BLE Unauthorized Command Injection Vulnerability Analysis

More from this source