Missing authentication lets an attacker rewrite a cardiac wearable

MedDevice Cyber Staff · May 28 · 2 min read · Via CISA

Fourth Frontier drew ICSMA-26-148-01 for the Frontier X and Frontier X2 wearable cardiac monitors and their mobile apps. CVE-2026-5768, missing authentication for a critical function, base score 8.8. An attacker reads and writes arbitrary handle values and alters clinical readings, which on an ECG wearable is the whole product. A monitor an attacker can rewrite is a monitor that can lie to a clinician.

Authentication on a critical function is the check that makes a caller prove it is allowed before the device acts. Where that check is missing, the device treats any party able to deliver the request as authorized, and on a wirelessly driven product the population able to deliver a request is everyone within radio range. The handle values in question are the attributes the device exposes over its wireless link, the fields holding its settings and its data.

An electrocardiogram is worth only what a clinician's trust in the trace makes it. A wearable whose readings can be rewritten erodes that trust at the source, because a falsified rhythm can steer care the wrong way, masking a real event or inventing one that never happened. Tampering of this sort leaves a plausible record rather than an obvious gap, which is what makes an integrity flaw on a diagnostic wearable so corrosive.

Proximity is the natural limit on a flaw like this, since the attacker must be near enough for the wireless link to reach, yet in a clinic corridor, a waiting room or a shared home space that distance is undemanding. Once a vendor engages, corrections to this class of defect travel the same coordinated path, a private report, an advisory, and updated software, before the weakness becomes public knowledge.

Fixed in Android 15.0.0 and iOS 25.0.0, though the X2 was listed as all-versions affected. Shakir Zari and Jerin Sunny reported it. Consumer cardiac wearables keep arriving with the security maturity of fitness trackers and the clinical weight of diagnostic devices, and the gap between those two is where these findings live.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The Frontier X ECG wearable let arbitrary handle values be read and written without authentication, CVE covered in ICSMA-26-148-01 at CVSS 8.8, which means clinical readings could be altered. Update to the fixed app and firmware and, until then, keep pairing to trusted phones only.

Update the wearable and apps. Apply the fixed firmware and app versions from ICSMA-26-148-01.
Require authentication on every BLE handle. Read and write access to characteristics that carry clinical data must be gated behind pairing and authentication, not left open.
Limit pairing exposure. Pair only in trusted settings until updated, since an unauthenticated attacker in range can rewrite values.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

net_wireless data_phi

Contributing

app_user_accounts app_mobile net_remote_access parse_waveform sys_firmware_update use_home use_hospital_net

EMB3D

PID-331 PID-41 PID-4111

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Questions & Answers

What is the flaw in the Frontier X ECG monitor?

The Frontier X wearable and its apps let a client read and write arbitrary handle values without authentication. In practice that means an unauthenticated party could change what the device stores or reports.

How is it rated?

CVSS 8.8 under ICSMA-26-148-01. It sits high because it combines missing authentication with the ability to write, not just read.

What is the guidance for users and the vendor?

The vendor fix is tracked in the advisory. Until it is in place, keep the device paired only to trusted phones and limit exposure of the app's interfaces.

← Back to Vulnerabilities