Security readout for executives and security teams
Plain-English summary
This vulnerability affects the Fastrack Reflex 2.0 activity tracker and lets an unauthenticated attacker alter the device date and time through Bluetooth LE behavior. The business impact is limited but real: timestamps and device state can become unreliable. There is no cited evidence of active exploitation.
Executive priority
Treat this as a moderate, narrow-scope integrity issue. It is unlikely to drive enterprise compromise, but it can undermine trust in wearable-generated timestamps. Prioritize replacement or vendor follow-up only where these devices support operational, compliance, or evidentiary decisions.
Technical view
CVE-2021-35952 describes improper Bluetooth LE protection in Fastrack Reflex 2.0 W307S_REFLEX_v90.89. The reported impact is integrity-only: a remote unauthenticated attacker can change time, date, and month via a BLE characteristic on handle 0x0017. The CVSS 3.1 score is 5.3 with no confidentiality or availability impact listed.
Likely exposure
Exposure appears limited to users or fleets with Fastrack Reflex 2.0 W307S_REFLEX_v90.89 devices. Because the described path is Bluetooth LE, practical exposure is most relevant where attackers can interact with the device over BLE. The CVE record does not provide CPEs or broader affected product ranges.
Exploitation context
The provided sources do not show public weaponization, active exploitation, or CISA KEV listing. The advisory title indicates lack of Bluetooth LE pairing, but the bundle does not include enough detail to confirm exploit prevalence, patch availability, or real-world abuse.
Researcher notes
The source data is thin: no CWE, no CPEs, no patch status, and no exploitation evidence are provided. The key technical fact is unauthenticated modification of date/time values through BLE characteristics. Avoid assuming adjacent data access or broader device takeover without additional vendor or advisory evidence.
Mitigation direction
- Check Fastrack guidance for firmware, replacement, or vendor-supported remediation.
- Do not rely on affected tracker timestamps for security, compliance, or evidence records.
- Retire or replace impacted trackers where accurate time and date are operationally important.
- Restrict use in sensitive areas if untrusted BLE interaction is unacceptable.
Validation and detection
- Inventory whether Fastrack Reflex 2.0 W307S_REFLEX_v90.89 devices are in use.
- Confirm firmware/model details from device management records or physical inspection.
- Review whether tracker timestamps feed business, safety, or compliance workflows.
- Monitor vendor and advisory pages for confirmed remediation information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35952 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.