CVE-2021-35951

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
Dec 26, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-359525.3fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE CharaCVE-2021-359537.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted cCVE-2021-359548.1fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious CVE-2021-359554.8Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.CVE-2021-359565.4Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackersCVE-2021-359576.7Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can reCVE-2021-359589.1TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extraCVE-2021-359595.4In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tCVE-2021-35966.5A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is dueCVE-2021-359619.8Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackCVE-2021-359627.5Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. RemoteCVE-2021-359639.8The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthe
CVE-2021-35951: High severity, CVSS 7.5 | Vulnix