{"id":"CVE-2026-121816","kind":"vulnerability","aliases":["CVE-2026-121816"],"related":[],"title":"Herowatch Mini: missing authentication lets remote attackers open an ADB shell","description":"Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations.","summary":"Herowatch Mini, from About Time Technologies, exposes its ADB service with no authentication, so an attacker who can reach it on the network gets a shell. TWCERT/CC says the product is no longer maintained and there will be no fix; users should replace it.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Herowatch Mini","fixed":[],"affected":"all versions (per TWCERT: Herowatch Go App all versions)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adb","end-of-life","herowatch-mini","infrastructure","iot","no-fix"],"not_affected_if":["adb-disabled","isolated-network"],"how_to_check":"Check whether the device's ADB service (typically TCP 5555) accepts connections from other hosts on its network segment: nmap -p 5555 <device-ip>, or adb connect <device-ip>:5555. If it connects without any prompt, the device is exposed. TWCERT's CVSS vector is adjacent-network (AV:A), so the risk is mainly hosts on the same LAN/Wi-Fi segment; also check whether the port is forwarded or exposed to the internet.","fix":"No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.","status":"open","published_at":"2026-11-04T07:17:11+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","triaged_at":"2026-11-04T07:26:22+00:00","updated_at":"2026-11-04T07:27:20+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-04T07:26:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Herowatch Mini: missing authentication lets remote attackers open an ADB shell","impact":"high","summary":"Herowatch Mini, a device from About Time Technologies, exposes its ADB service without authentication. A remote attacker who can reach that service gets an ADB shell on the device and can access its resources.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["herowatch-mini","adb","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gets an ADB shell and reaches device resources remotely","analyst_note":"Find the vendor advisory or the NVD CPE list for affected firmware versions and the fixed version; the sources give no fix or version range.","how_to_check":"- Check whether the device's ADB service (typically TCP port 5555) is reachable from networks outside the device's own segment, for example with `nmap -p 5555 <device-ip>` from another network.\n- Confirm the exact Herowatch Mini model and firmware version against the vendor's product notice, which the sources do not name.","plain_action":"","needs_analyst":true,"not_affected_if":["adb-disabled","isolated-network"],"who_is_affected":"Any Herowatch Mini device with its ADB service reachable over the network is exposed, since the flaw is missing authentication on that service. Devices whose ADB service is disabled or limited to an isolated network segment are less exposed. The sources do not name the affected firmware versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4104,"output_tokens":564,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the NVD CPE list for affected firmware versions and the fixed version; the sources give no fix or version range.","search":"'-121816':14A,17A '-2026':13A,16A 'access':106C 'adb':10A,20B,41B,98C,103C 'affect':95C 'attack':7A,48B,90C 'authent':4A,45B,86C 'connect':92C 'cve':12A,15A 'develop':78C 'devic':96C,107C 'end':22B 'end-of-lif':21B 'expos':39B 'fix':32B,72B 'get':56B 'herowatch':1A,18A,26B,33B,76C 'herowatch-mini':25B 'infrastructur':28B 'iot':29B 'let':5A 'life':24B 'longer':65B 'maintain':66B 'mini':2A,19A,27B,34B,77C 'miss':3A,85C 'network':55B 'no-fix':30B 'obtain':101C 'open':8A 'oper':112C 'perform':110C 'product':62B 'reach':51B 'relat':111C 'remot':6A,89C 'replac':75B 'resourc':108C 'say':60B 'servic':42B,99C 'shell':11A,58B,104C 'technolog':38B,82C 'therebi':105C 'time':37B,81C 'twcert/cc':59B 'unauthent':88C 'user':73B 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Herowatch Mini devices from About Time Technologies, which expose ADB with no authentication, so anyone who can reach the device on the network gets a shell. TWCERT/CC's advisory lists the affected product as 'Herowatch Go App all versions' and gives no firmware range, and it rates the attack as adjacent-network. Devices on an isolated network or with ADB disabled are less exposed.","tier":"B","verified":{"fix":{"at":"2026-11-04T07:27:20Z","by":"analyst","doc":"https://www.twcert.org.tw/en/cp-139-11356-8292a-2.html","run_id":1644},"who_affected":{"at":"2026-11-04T07:27:20Z","by":"analyst","doc":"https://www.twcert.org.tw/en/cp-139-11356-8292a-2.html","run_id":1644}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["herowatchmini","mini"],"ptokens":["herowatch","mini"],"labels":["adb","endoflife","herowatchmini","high","infrastructure","iot","nofix"],"campaign_type":null,"first_public_at":"2026-11-04T07:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121816","severity":null,"published_at":"2026-11-04T07:17:11+00:00","modified_at":"2026-11-04T07:17:11+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","fetched_at":"2026-11-04T07:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121816:1644","url":null,"severity":null,"published_at":"2026-11-04T07:27:20+00:00","modified_at":"2026-11-04T07:27:20+00:00","first_seen_at":"2026-11-04T07:27:20+00:00","fetched_at":"2026-11-04T07:27:20+00:00","note":"Primary: TWCERT/CC TVN-202611001 (CNA). Product EOL, no fix, replace device. Vector is adjacent (AV:A), not internet. Advisory's affected-product name (Herowatch Go App) is inconsistent with Mini; firmware versions unknown. No exploitation or PoC found."}],"documents":[{"id":65113,"url":"https://www.twcert.org.tw/en/cp-139-11356-8292a-2.html","title":"TWCERT/CC TVN-202611001: Herowatch Mini - Missing Authentication","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}