CISA issued a medical device advisory (ICSMA-26-223-01) covering Quanovate’s Mira Hormone Monitor firmware 1.7.1.47 and Mira Android App 4.5.15.4. The set of eight CVEs is dominated by identity and access weaknesses: missing authentication for critical functions, authentication bypass by spoofing, hard-coded credentials, weak authentication, and no rate limiting on authentication attempts. The highest-rated issue carries a CVSS v3 score of 9.8.
Successful exploitation could let an attacker access and modify sensitive health profile data, trigger denial-of-service, leak session tokens, and ultimately seize control of user accounts. The reliance on untrusted inputs for security decisions and the transmission of sensitive data via GET query strings compound the exposure of credentials and session material.
What to take away: this is a textbook example of how weak authentication design—hard-coded creds, missing auth, and no brute-force protection—leads directly to account takeover. Even outside enterprise AD, the same identity hygiene failures that CISA highlights here are exactly what defenders should audit for in any authentication surface.