No Pairing Required: Unauthorized Image Uploads to the smART Sketcher 2.0

Disclaimer: This research was conducted independently. Views expressed are my own and do not represent my employer.

Introduction

My kids received an interesting present for Christmas this year - something called the smART Sketcher 2.0 from Flycatcher Toys. It’s heavily advertised and was even featured on The Today Show and several news outlets as one of the best-selling toys for teaching children to draw. In short, it’s a bluetooth-enabled mini-projector that displays images onto paper, allowing kids to trace them and practice their drawing skills.

To use the toy, you have to sign up for an account on the mobile application and authenticate. The app allows you to upload images from your phone or device directly to the projector via Bluetooth.

Once we signed up, my daughter asked me to take a photo of her and upload it to her toy so she could practice drawing herself and other things around our house. As a security person, the first thing that came to mind was “Where are these images going when I upload them?” I had no intention of looking for any critical vulnerabilities - I just wanted to verify my images weren’t being sent over any network and were only being transmitted to the device.

Findings

I downloaded and decompiled the .apk and began sifting through the code, looking at the different API calls being used for user accounts, purchases, etc., as well as the image upload functionality. I found no evidence of the images being sent to anything other than the device itself, but I did notice something else rather alarming. There was no authentication being provided by the app to the device itself - no handshake, no pairing, no PIN, just a raw BLE connection to the characteristic with images and commands being sent in the clear.

I validated this by using LightBlue on my phone to connect to the device and successfully paired without any authentication. I wrote a small Python script that would connect and act as a ‘Bluetooth shell’, allowing me to test various inputs and observe the device’s response. By sending different hex values (0x02, 0x03, 0x04, 0x05, etc.), I was able to control the device remotely and switch between images, drawing steps, and other functions.

After taking a closer look at the decompiled .apk, I noticed the images had to be a specific size and chunked correctly. After adapting my Python script to handle the chunking properly, I was able to upload arbitrary images and have them immediately display on the device without any authentication whatsoever.

The Real Problem

This toy is great for children who want to enhance their artistic abilities, but here’s where it gets concerning: the device broadcasts itself as ‘smART Sketcher 2.0’ over Bluetooth. Anyone within range can see this, download the publicly available app, reverse engineer the protocol (just like I did), and send images directly to any nearby device. There’s nothing stopping a stranger in an apartment building, at a park, or on vacation from pushing inappropriate content to a child’s toy without the parent ever knowing. The device provides no indication that an unauthorized connection has been made, and there’s no way to disable this functionality.

For families living in apartments, taking the toy to public spaces, or traveling, this presents a real risk. An attacker doesn’t need physical access or any sophisticated tools - just a phone with Bluetooth and about 30 minutes of work to figure out the protocol.

Disclosure Timeline

I reached out to Flycatcher Toys early in the disclosure process to report this vulnerability, but received no response. VulDB also attempted to reach the Vendor and got no response. Given the nature of the device and its target audience, I felt it was important to make this information public so parents can make informed decisions about using this toy.

Overall Vulnerability Information

CWE-306 (Missing Authentication for Critical Function)

CVE Record: CVE-2026-0842 NVD

Proof of concept available on my github: Link