CVE-2026-89034

The TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 exposes a Nordic UART Service over Bluetooth Low Energy that enforces no client authentication or command authorization (CWE-306, missing authentication for critical function). Any attacker within BLE range can connect directly to the ring without pairing, authentication, or user approval, bypassing the official companion app and cloud authentication entirely. Once connected, the attacker can read the battery level, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records, yielding a high confidentiality/privacy impact with no integrity or availability impact. All wearers of this model on the affected firmware are exposed whenever the ring is powered and within Bluetooth range; there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation.

What to do: Check the firmware version in the companion app and apply a patched firmware from TCH when one becomes available (no fixed version was identified in this disclosure). Until then, power the ring off when not in use and be aware that any Bluetooth device within roughly 10 meters can silently read its health data without consent. This is a local, proximity-based privacy exposure, so remote detection and network-level mitigations do not apply.