CVE-2026-64934
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.
Risk Assessment
The risk includes the vendor's inability to detect vulnerable devices, potentially delaying patch distribution and exposing users to known threats. It may also affect compliance with security requirements.
Recommendation
It is recommended that the vendor implement independent firmware version attestation directly from the device. Users should update app and firmware only from trusted sources.
Original NVD description (English source)
The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.