The Mira hormone monitor firmware contains a missing authentication vulnerability that allows an adjacent attacker to gain unauthorized control over the device.

The vulnerability is identified as CWE-306, which relates to a missing authentication for a critical function. The attack vector is adjacent (AV:A), meaning the attacker must be on the same local network, and requires no authentication (PR:N) to achieve high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthorized party to manipulate personal health data or disrupt the functionality of the hormone monitor. With a CVSS score of 8.8, this high-severity flaw represents a significant risk to user privacy and device reliability, potentially leading to incorrect health tracking outcomes or unauthorized access to sensitive user information.

Immediate Action: Update the Mira mobile application to version 3.5.18 for iOS or 4.5.18 for Android. Once the application is updated, the firmware will automatically patch to version 01.07.01.53 when the device is connected.

Proactive Monitoring: Observe the device for unexpected connection requests or anomalous behavior during synchronization cycles.

Compensating Controls: Ensure the mobile device and the Mira monitor are connected to a secure, private network segment and avoid using the device on public or untrusted Wi-Fi networks.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the nature of medical monitoring devices, users should prioritize applying the provided firmware and application updates immediately. Ensuring the device is running the latest software version is the only effective way to remediate this authentication gap and secure sensitive health data.