Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-89034

CVE-2026-89034HIGH

TCH QRing R20_B006 Unauthenticated BLE Access

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   N   H   N   N    7.1   .0033   23.8     —

AFFECTED
  Product  Versions                  Fixed
  QRing    RT09R20_1.00.00_250318 –  —

TIMELINE
  Sep 10  Reserved by VulnCheck
  Sep 16  Published (CNA: VulnCheck)
  Sep 18  EXPLOIT PUBLISHED — CVE-2026-89034 (TCH QRing). Public exploit reference added.

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

Description

TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service which enforces no client authentication or command authorization. Attackers within Bluetooth Low Energy range can connect directly to the ring, bypassing the official application and cloud authentication, to read battery levels, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 10, 2026	Reserved	Reserved by VulnCheck
September 16, 2026	Published	Published (CNA: VulnCheck)
September 18, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-89034 (TCH QRing). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
TCH	QRing	—	RT09R20_1.00.00_250318	—

Weaknesses

CWE-306

References (2)

Authoritative record: CVE-2026-89034 at cve.org

Vendors: tch

Weaknesses: CWE-306

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-89034 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.