---
id: "CVE-2026-121818"
kind: "vulnerability"
aliases: ["CVE-2026-121818"]
title: "Herowatch Mini: public test signing key lets local users run code as admin"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Herowatch Mini", "fixed": [], "affected": "all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["end-of-life", "herowatch-mini", "local-accounts", "other", "windows"]
not_affected_if: ["no-local-user-access", "not-installed"]
published_at: "2026-11-04T07:17:12+00:00"
first_seen_at: "2026-11-04T07:25:30+00:00"
updated_at: "2026-11-04T07:27:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121818", "first_seen_at": "2026-11-04T07:25:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T07:27:33+00:00"}]
---

# Herowatch Mini: public test signing key lets local users run code as admin

Herowatch Mini, made by About Time Technologies, ships a publicly available test key that is used to sign its programs. A signed-in local attacker can use that key to sign malicious programs, which lets them raise their privileges and run arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Herowatch Mini affected all versions fixed ?

## How to check

Check whether you use a Herowatch Mini device (About Time Technologies). TWCERT lists all versions as affected, so there is no version to compare. The advisory says the device firmware is signed with a public test key. Also check Herowatch Go App installs: the advisory's affected-products line names 'Herowatch Go App all versions' while its description names Herowatch Mini, and the two don't match.

## Fix

No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.

## Timeline

- 2026-11-04T07:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121818
- 2026-11-04T07:27:33+00:00 analyst — TWCERT/CC TVN-202611003 (CNA): all versions, EOL, replace device, no fix. The advisory's affected-products line says Herowatch Go App but its description says Herowatch Mini; I kept Mini. Whether the test key is in production builds is unknown: the advisory says the device firmware uses it. Only the Chinese page was read; the English page was not found.

## Documents

- [advisory] TWCERT/CC TVN-202611003: Herowatch Mini system signing weakness (CVE-2026-121818) https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html

## From the sources

Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_