CVE-2026-5768: Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function

Synopsis

Missing authentication on critical functions in the Fourth Frontier X2 wearable and its companion Frontier X mobile applications. The flaw is reachable over Bluetooth Low Energy from an attacker within radio range, with no pairing, authorization, or credentials required; successful exploitation lets an attacker control device functions (start/stop activities, trigger vibrations, cause denial of service), and impersonate a legitimate device to inject fabricated health telemetry (heart rate, breathing rate, strain) into the mobile app. A patched-image rebuild at Android 15.0.0 and iOS 25.0.0 is available on HarborGuard for affected environments, though the Frontier X2 firmware itself remains without a listed fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  Exploitation requires adjacent-network access, specifically Bluetooth Low Energy radio range to the target device or phone.

• AuthenticationNot required

  No pairing, credentials, or prior authorization are needed; the GATT characteristics accept unauthenticated reads and writes.

• Victim interactionNot required

  The attacker can connect and interact with the device or impersonate one to the app without any user action.

• Attack complexityDetail

  Attack complexity is low: standard BLE tooling can read, write, and clone advertisements with reliable results.

Blast Radius

• Unauthorized control of the Frontier X2 device, including starting and stopping activities and triggering vibrations.
• Denial of service against the wearable through malformed GATT writes and characteristic fuzzing.
• Injection of fabricated health telemetry (heart rate, breathing rate, strain) into the mobile application by impersonating a legitimate device.
• Tampering with activity state and stored health records surfaced to the user and any downstream integrations.