Executive brief
The Mira cloud API for its hormone monitor device accepts any firmware version string reported by the companion app without verifying it against the actual device. An authenticated user could submit false firmware versions to hide their device's true patch status, evading security update prompts and hiding vulnerable devices from the vendor's vulnerability tracking systems. This undermines the vendor's ability to track and remediate security exposures across their user base.
Technical details
The vulnerability is a reliance on untrusted inputs in a security decision (CWE-345 / trust boundary violation). The Mira cloud API accepts firmware version strings reported by the companion app as authoritative without independently attesting the version from the device itself. An authenticated attacker could craft arbitrary firmware version strings in API calls, allowing them to spoof patch status. Attack preconditions include valid authentication to the cloud API and control of the companion app (or network interception of its requests). The impact includes evasion of vendor-side vulnerable fleet analytics, suppression of user-facing security update prompts, and misrepresentation of patch adoption metrics. A fix requires server-side validation of firmware versions against the actual device or cryptographic attestation from the device itself.
Affected products
- Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47
- Quanovate Tech Inc. Mira Android App 4.5.15.4
Timeline
- 2026-08-11: disclosed