Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
The Mira hormone monitor is a home device that measures hormone levels and syncs results through a mobile app and a cloud service. CISA's advisory covers eight vulnerabilities across all three: the device firmware (v1.7.1.47), the Android app (v4.5.15.4), and the cloud API. It's a clear example of why a connected device's threat model has to cover the app and the cloud, not just the hardware.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-68067 | The cloud API's login endpoint accepts any properly formatted string as the password (CWE-1390) | Spoofing | High | High |
| CVE-2026-67568 | The distributed Android app embeds credentials that give an attacker read and write access (CWE-798) | Information disclosure, Tampering | High | High |
| CVE-2026-66340 | The cloud authentication endpoints don't enforce per-account rate limiting (CWE-307) | Spoofing | High | Medium |
| CVE-2026-66875 | An unauthenticated attacker within BLE range can silently rebind the device (CWE-306) | Spoofing, Tampering | Medium | High |
| CVE-2026-66098 | Any BLE central can write a value that reboots the device into bootloader mode, without authentication (CWE-306) | Denial of service | Medium | High |
| CVE-2026-67558 | The Android app identifies its paired analyzer by a substring match, so another device can impersonate it (CWE-290) | Spoofing | Medium | High |
| CVE-2026-66832 | In-app web content passes sensitive information in URL query strings (CWE-598) | Information disclosure | Medium | High |
| CVE-2026-64934 | The cloud API treats the firmware version reported by the app as an authorization input (CWE-807) | Elevation of privilege | Medium | Medium |
Three are network-reachable with no privileges and no user action, so Exploitability reads High. The rest need Bluetooth range, a user action, or a login, so they read Medium. On Blue Goat's security matrix, the two cloud authentication flaws (CVE-2026-68067 and CVE-2026-67568) are Critical, and five others are High, as published.
The published vectors describe the product as CISA scored it, not your device. If you build on this product or a similar component, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
At High exploitability:
| Severity from your hazard analysis | Safety risk at High exploitability |
|---|---|
| Negligible | Medium |
| Minor or Serious | High |
| Critical or Catastrophic | Very High |
At Medium exploitability:
| Severity from your hazard analysis | Safety risk at Medium exploitability |
|---|---|
| Negligible | Low |
| Minor or Serious | Medium |
| Critical or Catastrophic | High |
Hormone results guide personal health decisions. An attacker who can log in as any user, or change what the app shows, can expose or alter those results.
What to check now
- Test your cloud login with malformed and arbitrary passwords, and confirm per-account rate limiting.
- Scan your mobile app builds for embedded credentials before every release.
- Bind app-to-device pairing to a cryptographic identity, not a name match.
- For Mira users, the fix is app iOS v3.5.18 or Android v4.5.18. Firmware v01.07.01.53 updates through the app when the device connects.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score each affected threat in your cybersecurity risk assessment, and carry any patient-harm result into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.