A missing authentication check in Fire‑Boltt BSW013 smartwatches running firmware up to V0.0.8 lets any nearby Bluetooth Low Energy device subscribe to the Heart Rate Measurement characteristic (0x2A37) without pairing, bonding, or additional confirmation. Through this flaw, an attacker can obtain the wearer’s real‑time heart rate, breaching personal privacy. The CVSS score of 2.3 reflects the low impact on confidentiality and the limited scope of the vulnerability, but it highlights a potential privacy breach for users who are unaware of a nearby unpaired device.

Fire‑Boltt BSW013 smartwatch, firmware versions through V0.0.8. The product lacks any authentication check when a remote device subscribes to the heart‑rate service, making all devices in range susceptible until the firmware is updated.

The flaw can be exploited only by an adversary within Bluetooth range; no special privileges or hunting for specific credentials are required. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. Nonetheless, an attacker can reliably capture a victim’s heart‑rate data in real‑time, which could have privacy or medical implications.