{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/about-time-technologies/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:about_time_technologies:herowatch_mini:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-121816"},{"cvss":7.8,"id":"CVE-2026-121818"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Herowatch Mini"],"_cs_severities":["high"],"_cs_tags":["vulnerability","iot","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["About Time Technologies"],"content_html":"\u003cp\u003eAbout Time Technologies Herowatch Mini is susceptible to a missing authentication vulnerability (CVE-2026-121816). This flaw allows unauthenticated remote attackers to connect directly to the Android Debug Bridge (ADB) service exposed on the device. Successful exploitation grants an attacker an ADB shell, providing full unauthorized access to device resources and the ability to execute arbitrary commands.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eUnauthorized remote actors can obtain an ADB shell on the device, leading to full compromise of device resources and potential persistent command execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Herowatch Mini devices currently connected to the network.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls (such as ACLs on firewalls or routers) to restrict access to the ADB service port (default TCP 5555) to trusted management IP addresses only.\u003c/li\u003e\n\u003cli\u003eContact the vendor for firmware update availability to address the missing authentication in the ADB service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T10:42:05Z","date_published":"2026-11-04T10:41:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-herowatch-mini-missing-auth/","summary":"The Herowatch Mini device contains a missing authentication vulnerability in its ADB service, allowing unauthenticated remote attackers to gain command execution via an ADB shell.","title":"About Time Technologies Herowatch Mini Missing Authentication (CVE-2026-121816)","url":"https://feed.craftedsignal.io/briefs/2026-11-herowatch-mini-missing-auth/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:about_time_technologies:herowatch_go_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-121817"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Herowatch Go Server"],"_cs_severities":["high"],"_cs_tags":["idor","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["About Time Technologies"],"content_html":"\u003cp\u003eCVE-2026-121817 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Herowatch Go Server developed by About Time Technologies. The vulnerability allows an authenticated attacker to manipulate specific request parameters to access, modify, or perform actions on data associated with other user accounts. The vulnerability carries a CVSS v3.1 base score of 7.5.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized data access and unauthorized execution of functions on behalf of other users within the application environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit access control implementations within the Herowatch Go Server API endpoints.\u003c/li\u003e\n\u003cli\u003eReview authentication logs and API request history for anomalous patterns where a single authenticated session accesses objects (IDs, usernames, or database keys) typically associated with multiple unique user accounts.\u003c/li\u003e\n\u003cli\u003eApply patches provided by About Time Technologies for Herowatch Go Server as soon as they become available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T08:39:57Z","date_published":"2026-11-04T08:39:57Z","id":"https://feed.craftedsignal.io/briefs/2026-11-herowatch-idor/","summary":"An Insecure Direct Object Reference (IDOR) vulnerability in About Time Technologies Herowatch Go Server allows authenticated remote attackers to access or modify data belonging to other users.","title":"About Time Technologies Herowatch Go Server: Insecure Direct Object Reference (CVE-2026-121817)","url":"https://feed.craftedsignal.io/briefs/2026-11-herowatch-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - About Time Technologies","version":"https://jsonfeed.org/version/1.1"}