---
id: "CVE-2026-121816"
kind: "vulnerability"
aliases: ["CVE-2026-121816"]
title: "Herowatch Mini: missing authentication lets remote attackers open an ADB shell"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Herowatch Mini", "fixed": [], "affected": "all versions (per TWCERT: Herowatch Go App all versions)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adb", "end-of-life", "herowatch-mini", "infrastructure", "iot", "no-fix"]
not_affected_if: ["adb-disabled", "isolated-network"]
published_at: "2026-11-04T07:17:11+00:00"
first_seen_at: "2026-11-04T07:25:30+00:00"
updated_at: "2026-11-04T07:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121816", "first_seen_at": "2026-11-04T07:25:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T07:27:20+00:00"}]
---

# Herowatch Mini: missing authentication lets remote attackers open an ADB shell

Herowatch Mini, from About Time Technologies, exposes its ADB service with no authentication, so an attacker who can reach it on the network gets a shell. TWCERT/CC says the product is no longer maintained and there will be no fix; users should replace it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Herowatch Mini affected all versions (per TWCERT: Herowatch Go App all versions) fixed ?

## How to check

Check whether the device's ADB service (typically TCP 5555) accepts connections from other hosts on its network segment: nmap -p 5555 <device-ip>, or adb connect <device-ip>:5555. If it connects without any prompt, the device is exposed. TWCERT's CVSS vector is adjacent-network (AV:A), so the risk is mainly hosts on the same LAN/Wi-Fi segment; also check whether the port is forwarded or exposed to the internet.

## Fix

No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.

## Timeline

- 2026-11-04T07:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121816
- 2026-11-04T07:27:20+00:00 analyst — Primary: TWCERT/CC TVN-202611001 (CNA). Product EOL, no fix, replace device. Vector is adjacent (AV:A), not internet. Advisory's affected-product name (Herowatch Go App) is inconsistent with Mini; firmware versions unknown. No exploitation or PoC found.

## Documents

- [advisory] TWCERT/CC TVN-202611001: Herowatch Mini - Missing Authentication https://www.twcert.org.tw/en/cp-139-11356-8292a-2.html

## From the sources

Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_