Is CVE-2026-64934 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64934 being exploited in the wild.

How severe is CVE-2026-64934?

Medium severity, with a CVSS score of 4.3, published 11 August 2026.

Which products and versions are affected?

Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.

Is there a fix for CVE-2026-64934?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-64934 attacked?

It is attacked over the network.

Am I affected by CVE-2026-64934?

Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64934: Mira cloud API arbitrary firmware version misrepresentation

CVE-2026-64934 · Severity: medium · CVSS 4.3 · Published 2026-08-11

The Mira cloud API for its hormone monitor device accepts any firmware version string reported by the companion app without verifying it against the actual device. An authenticated user could submit false firmware versions to hide their device's true patch status, evading security update prompts and hiding vulnerable devices from the vendor's vulnerability tracking systems. This undermines the vendor's ability to track and remediate security exposures across their user base.

Technologies: Quanovate Tech Inc. Mira Android App, Quanovate Tech Inc. Mira Monitor Firmware. Vendors: Quanovate Tech Inc..

Quick answers

Is CVE-2026-64934 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64934 being exploited in the wild.
How severe is CVE-2026-64934?: Medium severity, with a CVSS score of 4.3, published 11 August 2026.
Which products and versions are affected?: Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.
Is there a fix for CVE-2026-64934?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-64934 attacked?: It is attacked over the network.
Am I affected by CVE-2026-64934?: Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reliance on untrusted inputs in a security decision (CWE-345 / trust boundary violation). The Mira cloud API accepts firmware version strings reported by the companion app as authoritative without independently attesting the version from the device itself. An authenticated attacker could craft arbitrary firmware version strings in API calls, allowing them to spoof patch status. Attack preconditions include valid authentication to the cloud API and control of the companion app (or network interception of its requests). The impact includes evasion of vendor-side vulnerable fleet analytics, suppression of user-facing security update prompts, and misrepresentation of patch adoption metrics. A fix requires server-side validation of firmware versions against the actual device or cryptographic attestation from the device itself.

Affected products

Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47
Quanovate Tech Inc. Mira Android App 4.5.15.4

Timeline

2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.