TWCERT: Three High-Severity Vulnerabilities in Abouttime Tech Herowatch Series; Product Reached End-of-Life Without Patch

What Happened

CVE-2026-121817 (TVN-202611002): Herowatch Go Server contains an Insecure Direct Object Reference (IDOR) vulnerability that allows an authenticated remote attacker to modify specific parameters to access or manipulate other users' data and functions, with a 4.0 score of 8.7 (High) and a CVSS 3.1 score of 7.5 (High) ^[1].

CVE-2026-121818 (TVN-202611003, titled "Herowatch Go - Security Misconfiguration"): The advisory body notes that Herowatch Mini contains a system signature weakness in which the device firmware is signed using publicly available test keys, allowing an authenticated local attacker to sign malicious applications and gain highest system execution privileges, with a CVSS 4.0 score of 8.5 (High) and a CVSS 3.1 score of 7.8 (High) ^[2].

CVE-2026-121816 (TVN-202611001): Herowatch Mini contains a Missing Authentication vulnerability where an unauthenticated remote attacker who can reach the device's ADB service can directly establish a connection and obtain ADB shell privileges, with a CVSS 4.0 score of 8.7 (High) and a CVSS 3.1 score of 8.8 (High) ^[3].

Scope of Impact

The affected product field across all three advisories lists all versions of the Herowatch Go App, and the vulnerabilities were reported by researcher legendyang ^[1][2][3].

Response and Remediation

TWCERT/CC stated that the product has reached end-of-life and is no longer maintained, recommending that users replace it with supported devices; no patched versions are listed in the advisories ^[1].