Title: Flycatcher Toys smART Pixelator 2.0 2.0 Missing Authentication Description: - The smART Pixelator 2.0, a Bluetooth-enabled children's craft device, fails to implement authentication on its Bluetooth Low Energy interface. - The device exposes a writable BLE characteristic (UUID: 0000ffe6-0000-1000-8000-00805f9b34fb) that accepts connections and commands from any nearby Bluetooth device without requiring pairing, PIN, or any other form of authentication. - An unauthenticated attacker within Bluetooth range can connect to the device, upload arbitrary messages and images displayed on the LED grid, and control device functions. - The vulnerability affects devices in homes, apartments, schools, daycare, and other settings. - A mobile application requiring user authentication is provided, but the BLE service accepts connections from any client, bypassing the app. - The vulnerability affects all versions of the toy. - The same architectural vulnerability is found in the vendor's smART Sketcher 2.0 product (CVE-2026-0842). - The user has reached out to the vendor multiple times without response. Source: https://github.com/davidrochester/smart-pixelator-upload User: davidrochester (UID 94063) Submission Date: 01/23/2026 01:04 AM Moderation Date: 02/06/2026 07:56 AM Status: Accepted VulDB Entry: 344632 [Flycatcher Toys smART Pixelator 2.0 Bluetooth Low Energy Interface missing authentication] Points: 20