Paper/Archive/CVE-2026-68067

CVE-2026-68067

Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware — Mira Hormone Monitor, Mira Android App Weak Authentication

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.7.437 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

Affected

ProductAffectedFixed inSource

Mira Firmware1.7.1.47–CNA

Mira Android App4.5.15.4–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json