The Frontier X2 device exposes critical GATT characteristics through BLE without any authentication or authorization checks. An attacker who can reach the device via BLE can read or write these characteristics, allowing them to start or stop activities, trigger vibrations, or induce denial‑of‑service conditions. The companion mobile application also lacks proper device authentication, enabling an attacker to masquerade as a legitimate device and inject forged health telemetry such as breathing rate, heart rate, and strain data. This flaw represents a significant compromise of device integrity and confidentiality of patient data.

The flaw impacts the Fourth Frontier Frontier X Android and iOS mobile applications as well as the Frontier X2 medical device. No specific version numbers are listed, so any current installation of these products is potentially vulnerable.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local BLE connection; an attacker must be within Bluetooth range but does not need elevated privileges or remote network access. The lack of authentication makes exploitation straightforward for anyone who can transmit BLE commands to the device.