CVE-2026-0842: smART Sketcher Auth Bypass Vulnerability

CVE-2026-0842 Overview

A missing authentication vulnerability has been discovered in the Flycatcher Toys smART Sketcher, affecting versions up to 2.0. The flaw exists within the Bluetooth Low Energy (BLE) Interface component, allowing attackers within adjacent network range to interact with the device without proper authentication. This vulnerability enables unauthorized access to device functionality, potentially allowing malicious actors to send arbitrary commands or data to the children's drawing toy.

Critical Impact

Attackers within Bluetooth range can bypass authentication on the smART Sketcher device, potentially allowing unauthorized control of the toy and exposure of any connected functionality without user knowledge or consent.

Affected Products

• Flycatcher Toys smART Sketcher up to version 2.0
• smART Sketcher Bluetooth Low Energy Interface component

Discovery Timeline

• 2026-01-11 - CVE-2026-0842 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-0842

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication), indicating a fundamental flaw in how the device validates connecting clients. The smART Sketcher device fails to implement proper authentication mechanisms on its Bluetooth Low Energy interface, allowing any device within range to establish a connection and interact with the toy's functionality.

The adjacent network attack vector requirement means exploitation requires physical proximity to the target device—typically within Bluetooth range of approximately 10-100 meters depending on the environment and equipment used. While this limits remote exploitation scenarios, it creates significant concerns in environments where children's toys are commonly found, such as homes, schools, and public spaces.

A proof-of-concept demonstrating this vulnerability has been published publicly, increasing the risk of exploitation. The vendor was contacted about this disclosure but did not respond, leaving affected devices without an official remediation path.

Root Cause

The root cause lies in the absence of authentication controls on the Bluetooth Low Energy interface. The device accepts connections and commands from any BLE-capable device without verifying the identity or authorization of the connecting party. This design flaw allows unauthorized entities to interact with the smART Sketcher as if they were the legitimate companion application.

Attack Vector

The attack requires the adversary to be within Bluetooth Low Energy range of the target device. Once in range, an attacker can:

1. Scan for and discover the smART Sketcher device via BLE
2. Establish a connection without providing any authentication credentials
3. Send commands or data to the device as if they were the authorized user

The vulnerability exploitation process involves connecting to the device's BLE GATT services and interacting with exposed characteristics. Technical details and a proof-of-concept implementation are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-0842

Indicators of Compromise

• Unexpected Bluetooth connections to smART Sketcher devices from unknown sources
• Unusual device behavior such as unsolicited drawing commands or content uploads
• Multiple rapid connection attempts to the device's BLE interface
• Device activity occurring when the legitimate companion app is not in use

Detection Strategies

• Monitor for unauthorized BLE pairing attempts or connections in proximity to known device locations
• Implement network monitoring solutions capable of detecting anomalous Bluetooth traffic patterns
• Review companion application logs for unexpected disconnect/reconnect events that may indicate connection hijacking
• Deploy IoT security solutions that can identify and alert on rogue BLE connections

Monitoring Recommendations

• Enable logging on any network infrastructure that monitors wireless protocols in sensitive areas
• Consider using BLE scanning tools to audit which devices are connecting to IoT toys
• Implement physical security controls to limit attacker proximity to vulnerable devices
• Educate users about the vulnerability and encourage monitoring device behavior for anomalies

How to Mitigate CVE-2026-0842

Immediate Actions Required

• Limit use of affected smART Sketcher devices until a security update is available
• Store devices in locations where unauthorized physical proximity is difficult to achieve
• Disable Bluetooth on the device when not actively in use if such functionality exists
• Consider discontinuing use of the device in public or shared environments

Patch Information

No official patch is currently available from the vendor. According to the vulnerability disclosure, the vendor was contacted but did not respond. Users should monitor official Flycatcher Toys communications for any future security updates.

For additional technical information about this vulnerability, refer to the VulDB entry #340442.

Workarounds

• Power off the device when not in active use to prevent unauthorized BLE connections
• Use the device only in private, controlled environments where attacker proximity can be minimized
• Monitor the device's behavior during use for any unexpected activity indicating compromise
• Consider using RF shielding or Faraday bags when transporting the device to prevent opportunistic attacks