CVE-2026-89034

MEDIUM 6.5

TCH QRing R20_B006 Unauthenticated BLE Access

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service which enforces no client authentication or command authorization. Attackers within Bluetooth Low Energy range can connect directly to the ring, bypassing the official application and cloud authentication, to read battery levels, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records.

CWE	CWE-306
Vendor	tch
Product	qring
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for tch qring

Be the first to know when new medium vulnerabilities affecting tch qring are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

TCH / QRing

RT09R20_1.00.00_250318

References

NVD ↗ CVE.org ↗ EPSS Data ↗

mrvar0x.com: https://mrvar0x.com/2026/05/19/reverse-engineering-hidden-capabilities-in-smart-ring-ecosystems/ mrvar0x.com: https://mrvar0x.com/wp-content/uploads/2026/07/Reverse-Engineering-Hidden-Capabilities-in-Smart-Ring-Ecosystems-WhitePaper.pdf

Credits

Yehia Elghaly (Mrvar0x)