Frontier X wearable health monitors exposed to Bluetooth attacks
Fourth Frontier Frontier X/X2 wearable health monitors contain unauthenticated Bluetooth LE vulnerabilities allowing attackers to manipulate device functions and inject false health telemetry.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA disclosed a critical vulnerability (CVE-2026-5768) affecting Fourth Frontier's Frontier X and X2 wearable cardiac monitoring devices and their companion mobile applications. The devices allow unauthenticated Bluetooth Low Energy (BLE) read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. Attackers within BLE range can perform unauthorized control of device functions including starting or stopping activities, triggering vibrations, causing denial-of-service conditions, and fuzzing characteristic values to induce unexpected behavior.
The companion mobile applications (Android versions below 15.0.0 and iOS versions below 25.0.0) lack proper BLE device authentication, enabling attackers to impersonate legitimate Frontier X2 devices. By cloning BLE advertisements and exposing expected GATT characteristics, attackers can inject fabricated health telemetry including breathing rate, heart rate, strain, and other physiological data into the application. This manipulation of clinical readings could result in device takeover and potential patient harm.
Fourth Frontier is developing a fix but has not yet released remediated firmware or application versions. The vendor recommends users connect their devices through the official app before starting activities, leveraging the single-connection limitation as a temporary mitigation. CISA notes no known public exploitation has been reported, though the vulnerability is exploitable by attackers within Bluetooth range of affected devices.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-148-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs