The flaw allows an attacker connected to the device’s local network to interact with the Bluetooth Low Energy interface without any form of authentication, effectively bypassing access controls. Because authentication is missing, an attacker can manipulate functionality of the component, potentially altering settings or extracting sensitive data that the device processes or stores. The impact is confined to the device’s internal state and the information it handles, but a compromised device can be used as an uncontrolled endpoint in further attacks.

The vulnerability is present in Flycatcher Toys smART Pixelator 2.0, specifically within its Bluetooth Low Energy component. No other versions or variants are listed as affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not in the CISA KEV catalog, implying it has not been widely leveraged in known exploits. However, the exploit is publicly available and can be executed from the local network, meaning any device on the same LAN or local segment is potentially vulnerable. Without an official vendor fix, the risk relies on the attacker’s presence on the local network and their ability to interact with the BLE interface.