PT-2026-6786 · Flycatcher Toys · Smart Pixelator 2.0

Davidrochester · Published 2026-02-06 · Updated 2026-03-05 · CVE-2026-2065

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flycatcher Toys smART Pixelator 2.0

Description A security flaw exists in Flycatcher Toys smART Pixelator 2.0, specifically within the Bluetooth Low Energy Interface component. A manipulation of this component results in missing authentication. This attack can only be performed from the local network. The exploit has been publicly released and may be used for malicious purposes. The vendor was informed of this issue but did not provide a response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-287

CWE-862

Related Identifiers

CVE-2026-2065

Affected Products

Smart Pixelator 2.0

References · 9

• 🔥 https://github.com/davidrxchester/smart-pixelator-upload/blob/main/poc.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2065 · Security Note
• https://t.me/CVEtracker/43968 · Telegram Post
• https://vuldb.com/?submit.745129 · Note
• https://twitter.com/CVEnew/status/2019876698897150244 · Twitter Post
• https://github.com/davidrxchester/smart-pixelator-upload · Note
• https://vuldb.com/?ctiid.344632 · Note
• https://vuldb.com/?id.344632 · Note
• https://t.me/cveNotify/154394 · Telegram Post