CVE-2026-121816

HighCVSS 8.8/10Last modified Nov 4, 2026

Description

Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
About Time Technologies	Herowatch Mini	all

References

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1218177.5Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attacker CVE-2026-1218187.8Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly CVE-2026-1218195.9A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment withou CVE-2026-1218208.7A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-CVE-2026-1218215.3A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path CVE-2026-1218222.4A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross CVE-2026-1218238.7A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthentic CVE-2026-1218248.7A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memo CVE-2026-1218256.1OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provide CVE-2026-121839.8Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability CVE-2026-1218374.3A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @Secur CVE-2026-1218417.3Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0.