CVE-2026-18844

Received Received - Intake

Pulsetto Vagus Nerve Stimulator BLE Command Injection

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: ICS-CERT

Description

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18844

EUVD

EUVD-2026-56936

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-912	The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Pulsetto Vagus Nerve Stimulator firmware accepting undisclosed commands over its BLE interface without authentication or encryption. These commands are processed by the device when powered on, even though they are not issued by the official mobile app.

Detection Guidance

This vulnerability involves undocumented BLE commands processed by the Pulsetto Vagus Nerve Stimulator without authentication or encryption. Detection requires monitoring BLE traffic for unauthorized commands targeting the device. Use tools like Wireshark with BLE filters or hcitool to scan for unexpected BLE activity. Check device logs for unusual command processing.

Impact Analysis

An attacker within Bluetooth range could exploit this to send unauthorized commands to the device, potentially altering its function or behavior. This may lead to unintended stimulation or disruption of the vagus nerve stimulator's operation.

Compliance Impact

The vulnerability allows unauthorized commands to be sent to the Pulsetto Vagus Nerve Stimulator over unencrypted BLE without authentication. This could lead to unauthorized access or control of the device, potentially compromising user data or safety. Such risks may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) due to unauthorized access and lack of encryption.

Mitigation Strategies

Disable Bluetooth on the Pulsetto device when not in use. Ensure the device firmware is updated to the latest version if a patch is available. Isolate the device from other networked systems. Avoid using the device in untrusted environments. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-18844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70