CVE-2021-35952

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-35952
fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handle 0x0017.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex Third Party Advisory
https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex Third Party Advisory
https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 Permissions Required
https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 Permissions Required
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:fastrack:reflex_2.0_firmware:90.89:*:*:*:*:*:*:*
cpe:2.3:h:fastrack:reflex_2.0:-:*:*:*:*:*:*:*
History

14 Apr 2025, 19:15

Type Values Removed Values Added
References (MISC) https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 - Permissions Required () https://www.fastrack.in/shop/watch-smart-wearables-reflex-2 - Permissions Required
References (MISC) https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex - Third Party Advisory () https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex - Third Party Advisory
Information

Published : 2022-12-26 06:15

Updated : 2025-04-14 19:15

NVD link : CVE-2021-35952

Mitre link : CVE-2021-35952

JSON object : View

Products Affected

fastrack

  • reflex_2.0_firmware
  • reflex_2.0
CWE
NVD-CWE-noinfo