About Time Technologies Herowatch Mini Missing Authentication (CVE-2026-121816)
The Herowatch Mini device contains a missing authentication vulnerability in its ADB service, allowing unauthenticated remote attackers to gain command execution via an ADB shell.
CVE search metadata
CVE search record: CVE-2026-121816. Severity: high. CVSS: 8.8. KEV: no. Product: Herowatch Mini. Brief: About Time Technologies Herowatch Mini Missing Authentication (CVE-2026-121816). Brief link: https://feed.craftedsignal.io/briefs/2026-11-herowatch-mini-missing-auth/
CVE search record: CVE-2026-121818. Severity: high. CVSS: 7.8. KEV: no. Product: Herowatch Mini. Brief: About Time Technologies Herowatch Mini Missing Authentication (CVE-2026-121816). Brief link: https://feed.craftedsignal.io/briefs/2026-11-herowatch-mini-missing-auth/
Triage facts
Revision 1- Applicability
- Herowatch Mini
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 4, 10:41 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added CVE-2026-121818 Nov 4, 10:42 via nvd
About Time Technologies Herowatch Mini is susceptible to a missing authentication vulnerability (CVE-2026-121816). This flaw allows unauthenticated remote attackers to connect directly to the Android Debug Bridge (ADB) service exposed on the device. Successful exploitation grants an attacker an ADB shell, providing full unauthorized access to device resources and the ability to execute arbitrary commands.
Impact
Unauthorized remote actors can obtain an ADB shell on the device, leading to full compromise of device resources and potential persistent command execution.
Recommendation
- Identify all Herowatch Mini devices currently connected to the network.
- Implement network-level access controls (such as ACLs on firewalls or routers) to restrict access to the ADB service port (default TCP 5555) to trusted management IP addresses only.
- Contact the vendor for firmware update availability to address the missing authentication in the ADB service.
Immediate actions
Restrict network access to TCP 5555 for all identified Herowatch Mini devices
Threat Hunt
Detect unauthorized connection attempts to TCP port 5555
Data: Firewall or network ingress logs showing traffic to port 5555 from untrusted subnets
Mitigations
Disable external access to ADB service via firewall rules
CVE-2026-121816