HEROWATCH MINI · CVE-2026-121818 · Other
NO FIX YET · SEE WHAT TO DO
Herowatch Mini, made by About Time Technologies, ships a publicly available test key that is used to sign its programs. A signed-in local attacker can use that key to sign malicious programs, which lets them raise their privileges and run arbitrary code.
first public Nov 4, 2026 · 2 sources
Running Herowatch Mini? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone running a Herowatch Mini device from About Time Technologies, where a local account holder could sign and run their own programs with the public test key. TWCERT/CC lists all versions as affected and says the product is no longer maintained. Skip it if you have no such device, or if no untrusted user can log in locally.
Not affected if no-local-user-access, not-installed
Who cares end-of-life, herowatch-mini, local-accounts, windows
s affected-products line names Herowatch Go App all versions while its description names Herowatch Mini, and the two dont matchNo fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
This page as .md · .json · in your agent: get_signal("CVE-2026-121818") · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.