CISA flags Bluetooth flaw in Pulsetto stimulator that could alter settings
CISA warned that the Pulsetto Vagus Nerve Stimulator accepts undisclosed BLE commands without authentication or encryption, raising a high-severity risk.
CISA on 2026-08-11 published an industrial control systems medical advisory for the Pulsetto Vagus Nerve Stimulator, warning that the device accepts several undisclosed commands over its Bluetooth Low Energy, or BLE, interface.
The agency said the issue, tracked as CVE-2026-18844, could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. CISA rated the flaw high severity, with a CVSS v3.1 base score of 8.1 and a CVSS v4.0 base score of 7.2.
CISA said the vulnerability affects the Pulsetto Vagus Nerve Stimulator from vendor Pulsetto and is listed for vers:all/*.
The agency classified the problem as CWE-912, or hidden functionality. The advisory said the commands are sent without authentication or encryption, are not issued by the companion mobile application, and are still processed by the device when it is powered on.
CISA said no known public exploitation specifically targeting the vulnerability has been reported to the agency at this time, and that the issue is not exploitable remotely.
In the advisory’s background section, CISA identified the company headquarters location as Lithuania. The notice also said Pulsetto had not responded to requests to work with CISA to mitigate the vulnerability.
CISA acknowledged A.C. Buglione as the reporter of the vulnerability and directed users to [email protected] for assistance.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()