Vulnerability

Apollo Pharmacy APG-01 BT glucose meter sends readings over BLE in cleartext

MedDevice Cyber Staff · Jun 18 · 2 min read · Via CISA ICSMA-26-169-01

CISA published advisory ICSMA-26-169-01 on June 18, 2026, covering the Apollo Pharmacy Blood Glucose Monitoring System, Model No. APG-01 BT, firmware 0x0110_v1.1.0. Rishitha Pucchakayala of the Centre for Development of Advanced Computing (Hyderabad) reported two vulnerabilities, each scored 6.5 under CVSS v3.1.

CVE-2026-50034 (CWE-319) is cleartext transmission. An attacker within BLE range can passively intercept the traffic and read sensitive health information, including glucose measurement values. CVE-2026-52866 (CWE-862) is missing authorization on the connection itself: an attacker can occupy the meter's only BLE connection slot and lock out the legitimate app.

Both need radio proximity and neither is remotely exploitable, per CISA. The second matters more than its confidentiality-free score suggests, since a meter that cannot sync leaves the patient's app without readings.

Apollo Pharmacy did not respond to CISA's requests to coordinate, so there is no fix. CISA directs users to contact Apollo Pharmacy and to its Understanding Bluetooth Technology guidance. A consumer meter that pairs with anything nearby and talks in the clear has no security boundary at all.

Are you a representative of Apollo Pharmacy? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch: Apollo Pharmacy did not respond to CISA about CVE-2026-50034 and CVE-2026-52866 in the APG-01 BT, firmware 0x0110_v1.1.0. Users should contact Apollo Pharmacy directly and follow CISA's Bluetooth guidance. Pair and sync the meter only in private settings, and treat its readings as visible to anyone in radio range.

Contact Apollo Pharmacy. Ask the manufacturer directly about a firmware fix for the APG-01 BT.
Sync in private places. Both flaws need BLE range, so pair and transfer readings away from crowds.
Encrypt the BLE link by design. Manufacturers of similar meters should require authenticated, encrypted pairing before any measurement leaves the device.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wireless connectivity

Contributing

Handles patient data Home use Mobile app

Blood Glucose Monitoring System

PID-4112 PID-331 Wireless connectivity Handles patient data Home use

Fix the class in your product

The product can encrypt but does not by default. As the maker, make transport security the default and the only option, refuse to negotiate down to plaintext, and validate the certificate on the device rather than trusting the network.

Encrypt by default. Require TLS on every link and reject an unencrypted fallback.
Validate the peer. Verify or pin the certificate; keep credentials and tokens out of URLs.
Retire the plaintext mode. Remove the legacy cleartext option on a defined timeline rather than carrying it forever.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
FreeStyle Libre 2 Flash Glucose Monitoring System	Abbott	Same attributes (interface and component types)BLE, Mobile Application	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same attributes (interface and component types)BLE, Mobile Application	No feedback feed from manufacturer
Basal-IQ Technology	Tandem Diabetes Care	Same attributes (interface and component types)BLE, Mobile Application	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Same signals	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same signals	No feedback feed from manufacturer
Portrait Mobile Monitoring Solution consists of: • Portrait Central	GE HealthCare	Same signals	No feedback feed from manufacturer
Omnipod 5 ACE Pump	Insulet	Same signals	No feedback feed from manufacturer
Zio AT device	iRhythm	Same signals	No feedback feed from manufacturer
MULTIX Impact E	Siemens Healthineers	Same signals	No feedback feed from manufacturer
Connected OR Hub with Device and Voice Control	Stryker	Same signals	No feedback feed from manufacturer
SDC3 HD Information Management System with Wireless Device Control	Stryker	Same signals	No feedback feed from manufacturer
BlueStar and BlueStar Rx	Welldoc	Same signals	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Exposed to the same EMB3D threatTID-411	No feedback feed from manufacturer

Questions & Answers

What is CVE-2026-50034 in the Apollo Pharmacy APG-01 BT glucose meter?

CVE-2026-50034 is cleartext transmission in the Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT, firmware 0x0110_v1.1.0: an attacker within BLE range can intercept traffic and read glucose measurement values. CISA advisory ICSMA-26-169-01, published June 18, 2026, scores it 6.5.

Is there a fix for the Apollo Pharmacy APG-01 BT Bluetooth vulnerabilities?

No. Per CISA advisory ICSMA-26-169-01, Apollo Pharmacy did not respond to CISA's requests to coordinate on CVE-2026-50034 and CVE-2026-52866. CISA encourages users to contact Apollo Pharmacy directly and follow its Understanding Bluetooth Technology guidance.

How can an attacker block the Apollo Pharmacy glucose meter from connecting?

CVE-2026-52866 lets an attacker within BLE range monopolize the APG-01 BT meter's only available BLE connection slot, preventing legitimate users or apps from connecting, according to CISA advisory ICSMA-26-169-01. It scores 6.5 under CVSS v3.1.

← Back to Vulnerabilities