CVE-2026-18844
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.
Risk Assessment
An attacker within BLE range can send unauthorized commands to the medical device, potentially leading to unintended stimulator actions and possibly endangering user safety.
Recommendation
It is recommended to update the device firmware to a version that requires authentication and encryption for BLE commands, and to limit BLE range if possible.
Original NVD description (English source)
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.