# Apollo Pharmacy Glucose Monitor Exposes Patient Data Over Unencrypted Bluetooth


## The Threat


Apollo Pharmacy's APG-01 BT blood glucose monitoring system contains two critical Bluetooth Low Energy (BLE) vulnerabilities that allow attackers within wireless range to intercept sensitive health data and deny service to legitimate users. The vulnerabilities affect patients in India and potentially elsewhere who rely on this connected medical device for daily glucose monitoring—essential for managing diabetes and preventing life-threatening complications.


The first vulnerability (CVE-2026-50034) allows passive eavesdropping on BLE communications without authentication or authorization. An attacker positioned within Bluetooth range of the device can intercept wireless traffic and extract glucose measurement values, timestamps, and other health telemetry. This data is transmitted in cleartext over the radio link, providing no cryptographic protection against interception. For diabetes patients, glucose readings are highly sensitive personal health information; exposure risks privacy violations, insurance discrimination, and targeted social engineering attacks.


The second vulnerability (CVE-2026-52866) is a denial-of-service flaw stemming from missing authorization checks on BLE connection slots. The APG-01 BT supports only one concurrent Bluetooth connection. An attacker can monopolize this single available slot by establishing a BLE connection and refusing to disconnect, locking out the device owner and any companion applications trying to sync glucose data. This has direct clinical consequences—patients cannot upload readings to their healthcare provider, monitor trends in real time, or respond to alerts about dangerous glucose levels.


Both flaws reflect poor security architecture in a medical device where security requirements should be non-negotiable. The lack of encryption, authentication, and connection validation exposes a population dependent on these devices to both privacy violation and physical harm.


## Severity and Impact


| Aspect | Details |

|--------|---------|

| CVE-2026-50034 | Cleartext Transmission of Sensitive Health Information |

| CVE-2026-52866 | Missing Authorization / Denial of Service |

| CVSS v3.1 Score | 6.5 MEDIUM (both CVEs) |

| CVSS v4.0 Score | 7.1 HIGH (both CVEs) |

| CVSS v3.1 Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (CVE-2026-50034); AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVE-2026-52866) |

| Attack Vector | Adjacent Network (Bluetooth range) |

| Attack Complexity | Low |

| Authentication Required | None |

| User Interaction Required | None |

| CWE Identifiers | CWE-319 (Cleartext Transmission), CWE-862 (Missing Authorization) |

| Affected Versions | Apollo Pharmacy APG-01 BT, Model 0x0110_v1.1.0 |

| Vendor Coordination Status | Apollo Pharmacy did not respond to CISA disclosure attempts |


## Affected Products


  • Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT

    • - Model: APG-01 BT

    - Firmware Version: 0x0110_v1.1.0

    - Status: Known affected (no patch available)


    The vulnerability is specific to this model and firmware version. Users should verify their device version before determining if they are affected.


    ## Mitigations


    For Users of the APG-01 BT:


  • Contact Apollo Pharmacy directly to inquire about firmware updates or replacement. Apollo Pharmacy's contact page is available at https://www.apollopharmacy.in/contact-us.
  • Minimize Bluetooth exposure: Keep the device in a location where unauthorized individuals are unlikely to be within Bluetooth range (approximately 10-30 meters depending on environmental factors).
  • Disable Bluetooth when not in use: If the device supports this, turn off Bluetooth connectivity outside of scheduled sync windows to reduce the attack window.
  • Network segmentation: If glucose data syncs to a mobile app or home network, ensure these devices are on a isolated network segment with firewall protections, separate from sensitive systems.
  • Monitor for unauthorized connections: Check the device's Bluetooth pairing log or companion app for unexpected connection attempts.

    • For Healthcare Providers and Clinics:


  • Patient communication: Inform patients using this device about the vulnerabilities and advise on safe usage practices.
  • Alternative devices: Evaluate migration to alternative glucose monitoring systems with stronger security track records. Prioritize devices with end-to-end encryption and mutual authentication.
  • Data validation: When receiving glucose data from patients, implement additional validation checks to detect anomalies that might indicate intercepted or tampered readings.

    • General Bluetooth Security Practices:


  • Follow CISA's guidance on Bluetooth security in their resource: https://www.cisa.gov/news-events/news/understanding-bluetooth-technology.
  • For medical device procurement, require security assessments and vendor commitment to cryptographic protections in device firmware.

    • ## References


  • CISA Advisory: https://www.cisa.gov/news-events/alerts
  • Apollo Pharmacy Contact: https://www.apollopharmacy.in/contact-us
  • CISA Bluetooth Security Guidance: https://www.cisa.gov/news-events/news/understanding-bluetooth-technology
  • CVSS Calculator: https://www.first.org/cvss/calculator/3.1 and https://www.first.org/cvss/calculator/4.0
  • CVE-2026-50034: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50034
  • CVE-2026-52866: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52866

    • ---


    ## HackWire Analysis


    The Apollo Pharmacy vulnerability highlights a persistent problem in healthcare device security: vendors shipping connected medical devices without basic cryptographic protections, then going silent when researchers disclose the flaws. CISA's note that "Apollo Pharmacy did not respond to CISA's requests to coordinate" is the story within the story. This is not a vendor working urgently on a patch in the background—this is a vendor ignoring the disclosure process entirely.


    The attack surface is particularly concerning because it requires no sophistication. Any attacker with a smartphone and basic Bluetooth knowledge operating within 30 meters can passively harvest glucose readings or jam the device. There's no phishing, no malware, no social engineering required. The device hands over health data on a silver platter.


    This also underscores a blind spot in how we evaluate medical device security. A 6.5 CVSS score might look moderate, but the real-world impact is acute: a patient cannot monitor their diabetes, cannot sync critical health data with their doctor, and has no way to know their readings have been intercepted. For a person managing Type 1 diabetes or on insulin, interrupted device access is not merely inconvenient—it is a direct clinical risk.


    India's healthcare sector, where Apollo Pharmacy operates, has seen rapid expansion in digital health adoption. Connected glucose monitors, pulse oximeters, and other wearable sensors are proliferating in clinics and home use. This advisory is a reminder that scale without security is a trap. As devices proliferate, so do attack surfaces. Vendors in the Indian healthcare market need to treat encryption and authentication as mandatory, not optional.


    The lesson for defenders: assume your connected medical devices are vulnerable until proven otherwise. Segment them from broader networks, implement strict access controls, and demand vendor responses to security disclosures. If a vendor won't acknowledge a vulnerability, escalate to your procurement team and consider alternatives.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)