CVE-2026-64934

Description

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

References

https://www.hipaajournal.com/vulnerabilities-mira-hormone-monitor-pulsetto-vagus-nerve-stimulator/

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS