CISA flags eight Mira app and hormone monitor flaws, urges updates
CISA said eight vulnerabilities in the Mira Hormone Monitor and Mira Android App could expose health profile data, session tokens and user accounts. The agency urged users to update the app and device firmware.
CISA on Aug. 11 published a cybersecurity advisory on eight vulnerabilities affecting the Mira Hormone Monitor and the Mira Android App. The agency said the flaws could let an attacker access or change health information, trigger denial of service or take over accounts.
CISA said the issues involve both the device and the companion app. The agency said the vulnerabilities could expose health profile information, session token information and account access if successfully exploited.
According to the advisory, the affected products are the Mira Hormone Monitor and the Mira Android App, with affected versions listed as Mira Monitor Firmware 1.7.1.47 and Mira Android App 4.5.15.4. CISA identified the vendor as Quanovate Tech Inc., operating as Mira / Mira Care, and said the deployment scope is worldwide, with the company headquarters listed in the United States.
The advisory names eight CVEs: CVE-2026-66875, CVE-2026-66098, CVE-2026-67558, CVE-2026-67568, CVE-2026-68067, CVE-2026-66340, CVE-2026-64934 and CVE-2026-66832. CISA’s descriptions include unauthenticated BLE-range device rebinding, extraction of stored hormone measurements in cleartext, denial-of-service conditions tied to malformed or undocumented commands, spoofing of the paired analyzer, weak cloud login handling, a lack of rate limiting and account lockout, reliance on app-reported firmware versions and WebView handling that can expose live session tokens and a persistent user identifier.
CISA listed the highest CVSS scores for CVE-2026-67568 at 9.1 under CVSS v3.1 and 9.3 under CVSS v4.0, and for CVE-2026-68067 at 9.8 under CVSS v3.1 and 9.3 under CVSS v4.0. Other issues in the advisory carried scores ranging from medium to high severity, including CVE-2026-66875 at 8.8 and 8.7, CVE-2026-67558 at 7.4 and 8.2, CVE-2026-66098 at 6.5 and 7.1, CVE-2026-66832 at 6.5 and 6.9, CVE-2026-66340 at 5.3 and 6.9, and CVE-2026-64934 at 4.3 and 5.3.
The advisory said the mitigation across the issues is to update the Mira app to iOS v3.5.18 or Android v4.5.18. CISA said firmware v01.07.01.53 is updated through the app when the device is connected. The agency said no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
CISA’s acknowledgments name Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova and En Mong of Northeastern University SPQR Lab as reporters to Quanovate Tech.
CISA’s advisory is dated Aug. 11, and its revision history shows the initial publication on the same day.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()