{"id":"CVE-2026-121818","kind":"vulnerability","aliases":["CVE-2026-121818"],"related":[],"title":"Herowatch Mini: public test signing key lets local users run code as admin","description":"Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.","summary":"Herowatch Mini, made by About Time Technologies, ships a publicly available test key that is used to sign its programs. A signed-in local attacker can use that key to sign malicious programs, which lets them raise their privileges and run arbitrary code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Herowatch Mini","fixed":[],"affected":"all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["end-of-life","herowatch-mini","local-accounts","other","windows"],"not_affected_if":["no-local-user-access","not-installed"],"how_to_check":"Check whether you use a Herowatch Mini device (About Time Technologies). TWCERT lists all versions as affected, so there is no version to compare. The advisory says the device firmware is signed with a public test key. Also check Herowatch Go App installs: the advisory's affected-products line names 'Herowatch Go App all versions' while its description names Herowatch Mini, and the two don't match.","fix":"No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.","status":"open","published_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","triaged_at":"2026-11-04T07:26:22+00:00","updated_at":"2026-11-04T07:27:33+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T07:26:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Herowatch Mini: public test signing key lets local users run code as admin","impact":"high","summary":"Herowatch Mini, made by About Time Technologies, ships a publicly available test key that is used to sign its programs. A signed-in local attacker can use that key to sign malicious programs, which lets them raise their privileges and run arbitrary code.","audience":"businesses","category":"other","nicknames":[],"who_cares":["herowatch-mini","windows","local-accounts"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated privileges and runs arbitrary code","analyst_note":"Find the affected version range and vendor fix from About Time Technologies, and confirm whether the test key is shipped in production builds (source: https://nvd.nist.gov/vuln/detail/CVE-2026-121818).","how_to_check":"- Check whether Herowatch Mini is installed on the machine, and note its version (unknown: the sources do not name the affected versions)\n- unknown: the sources do not say which file or setting holds the signing key","plain_action":"","needs_analyst":true,"not_affected_if":["not-installed","no-local-user-access"],"who_is_affected":"Only systems where Herowatch Mini is installed and where someone with a local account could run code. The sources do not name affected versions, the product's deployment model, or whether the test key is in every build. unknown whether systems without the software are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4094,"output_tokens":547,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version range and vendor fix from About Time Technologies, and confirm whether the test key is shipped in production builds (source: https://nvd.nist.gov/vuln/detail/CVE-2026-121818).","search":"'-121818':16A,19A '-2026':15A,18A 'account':31B 'admin':13A 'allow':104C 'arbitrari':76B,111C 'attack':59B,92C 'authent':90C 'avail':44B,97C 'code':11A,77B,112C 'cve':14A,17A 'develop':80C 'elev':107C 'end':23B 'end-of-lif':22B 'execut':110C 'exploit':94C 'herowatch':1A,20A,27B,34B,78C 'herowatch-mini':26B 'key':6A,46B,63B,99C 'let':7A,69B 'life':25B 'local':8A,30B,58B,91C 'local-account':29B 'made':36B 'malici':66B,102C 'mini':2A,21A,28B,35B,79C 'privileg':73B,108C 'program':53B,67B,103C 'public':3A,43B,96C 'rais':71B 'run':10A,75B 'ship':41B 'sign':5A,51B,56B,65B,88C,101C 'signed-in':55B 'system':87C 'technolog':40B,84C 'test':4A,45B,98C 'time':39B,83C 'use':49B,61B 'user':9A 'vulner':89C 'window':33B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Herowatch Mini device from About Time Technologies, where a local account holder could sign and run their own programs with the public test key. TWCERT/CC lists all versions as affected and says the product is no longer maintained. Skip it if you have no such device, or if no untrusted user can log in locally.","tier":"B","verified":{"fix":{"at":"2026-11-04T07:27:33Z","by":"analyst","doc":"https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html","run_id":1642}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["herowatchmini","mini"],"ptokens":["herowatch","mini"],"labels":["endoflife","herowatchmini","high","localaccounts","other","windows"],"campaign_type":null,"first_public_at":"2026-11-04T07:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121818","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121818","severity":null,"published_at":"2026-11-04T07:17:12+00:00","modified_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","fetched_at":"2026-11-04T07:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121818:1642","url":null,"severity":null,"published_at":"2026-11-04T07:27:33+00:00","modified_at":"2026-11-04T07:27:33+00:00","first_seen_at":"2026-11-04T07:27:33+00:00","fetched_at":"2026-11-04T07:27:33+00:00","note":"TWCERT/CC TVN-202611003 (CNA): all versions, EOL, replace device, no fix. The advisory's affected-products line says Herowatch Go App but its description says Herowatch Mini; I kept Mini. Whether the test key is in production builds is unknown: the advisory says the device firmware uses it. Only the Chinese page was read; the English page was not found."}],"documents":[{"id":65117,"url":"https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html","title":"TWCERT/CC TVN-202611003: Herowatch Mini system signing weakness (CVE-2026-121818)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}