CVE Catalog
CVE-2026-18164
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk0.23%
14th percentile - higher than 14% of all known CVEs
Summary
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.
Risk Assessment
An attacker in proximity can take control of the medical device, potentially posing a serious threat to patient health.
Recommendation
Change default credentials to unique ones per device and restrict Bluetooth range if possible.
Original NVD description (English source)
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.