Defenders should note that these flaws allow unauthenticated attackers within BLE range (10-30 meters) to rebind devices, intercept cleartext hormone data, and disrupt fertility monitoring services. Furthermore, cloud-facing vulnerabilities in the associated Android APK permit unauthorized access to reproductive health profiles, potentially leading to the destruction or forgery of sensitive clinical data. The breadth of these flaws, particularly those enabling remote cloud-based exploitation and local BLE spoofing, presents a significant risk to the privacy and integrity of user healthcare information.

Impact

Successful exploitation allows for unauthorized access to sensitive reproductive health profiles, the ability to manipulate historical clinical trends, disclosure of session tokens, and complete loss of account control. These vulnerabilities affect the Healthcare and Public Health sector worldwide, directly impacting user safety and the reliability of fertility monitoring workflows.

Recommendation

• Immediately update the Mira Android application to version 4.5.18 or higher.
• Ensure the Mira Monitor hardware firmware is updated to version 01.07.01.53, which is triggered automatically via the updated Android application.
• Review network access logs for unusual patterns of interaction with Mira cloud API endpoints if the application was utilized in a high-threat environment.
• Monitor for anomalous BLE advertisement names that attempt to masquerade as legitimate Mira devices to facilitate peripheral spoofing.