HEROWATCH MINI · CVE-2026-121816 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Herowatch Mini, from About Time Technologies, exposes its ADB service with no authentication, so an attacker who can reach it on the network gets a shell. TWCERT/CC says the product is no longer maintained and there will be no fix; users should replace it.
first public Nov 4, 2026 · 2 sources
Running Herowatch Mini? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Herowatch Mini devices from About Time Technologies, which expose ADB with no authentication, so anyone who can reach the device on the network gets a shell. TWCERT/CC's advisory lists the affected product as 'Herowatch Go App all versions' and gives no firmware range, and it rates the attack as adjacent-network. Devices on an isolated network or with ADB disabled are less exposed.
Not affected if adb-disabled, isolated-network
Who cares adb, end-of-life, herowatch-mini, iot, no-fix
No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.
Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations.
This page as .md · .json · in your agent: get_signal("CVE-2026-121816") · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.