CVE-2026-0842

Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication

CVSS 5.3 MEDIUMEPSS 0.4%CWE-287 CWE-306

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A flaw has been found in Flycatcher Toys smART Sketcher up to 2.0. This affects an unknown part of the component Bluetooth Low Energy Interface. This manipulation causes missing authentication. The attack can only be done within the local network. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

Flycatcher Toys · smART Sketcher

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/davidrxchester/smart-sketcher-upload/blob/main/smartsketch-upload.py https://vuldb.com/?ctiid.340442 https://vuldb.com/?id.340442 https://vuldb.com/?submit.729134