The Cybersecurity and Infrastructure Security Agency has issued a medical advisory warning of a critical vulnerability in Fourth Frontier cardiac monitoring devices that could let attackers alter clinical readings and potentially harm patients.
Tracked as CVE-2026-5768 and carrying a CVSS score of 8.8, the flaw resides in the Frontier X2 cardiac monitor and the Frontier X mobile application. The device allows unauthenticated Bluetooth Low Energy read and write access to critical GATT characteristics without enforcing pairing authentication. Attackers within BLE range can start or stop activities, trigger vibrations, cause denial-of-service conditions, and inject fabricated health telemetry including heart rate, breathing rate, and strain data into the mobile app.
The vulnerability also allows attackers to clone BLE advertisements and impersonate a legitimate Frontier X2 device, connecting to the app and manipulating activity states. CISA warned that successful exploitation could allow an attacker to read and write arbitrary handle values and change clinical readings, which could result in taking control of the device and lead to patient harm.
Fourth Frontier is aware of the vulnerability and working on a fix. In the interim, CISA recommends users connect the Frontier X or X2 device using the Frontier X app first before starting an activity, as the devices can only connect to one app at a time. The Frontier X Android application versions before v15.0.0 and iOS versions before v25.0.0 are affected, along with all Frontier X2 versions.
The affected devices are used worldwide across the healthcare and public health sector. Researchers Shakir Zari and Jerin Sunny reported the vulnerability to CISA.
