This vulnerability arises from missing authentication in an unknown part of Flycatcher Toys smART Sketcher’s Bluetooth Low Energy Interface. An attacker who can position themselves on the same local network can send unauthorized Bluetooth commands to the toy, potentially taking control or causing unintended behavior. The weakness maps to CWE‑287 and CWE‑306, indicating a failure to properly authenticate requests and enforce security controls. The impact is limited to devices that expose the BLE interface, but any connected user could be affected if the toy is used in an uncontrolled environment.

Flycatcher Toys smART Sketcher devices with firmware versions up to and including 2.0 are affected. No additional product or version information is available in the current report.

The CVSS score of 5.3 places the vulnerability in the medium range, while the EPSS score of less than 1 % suggests a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be within the local network to exploit the flaw, so exposure is limited to physically or logically proximate devices. Because the vendor has not issued a patch or response, the risk remains present until an official fix is released or mitigated through configuration changes.