EUVD-2026-56936
GHSA-qhgm-pqrh-9j38
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
BLE constrains exploitation to physical adjacency (AV:A); no authentication or configuration prerequisite exists (PR:N, AC:L); confidentiality impact is not confirmed from available data.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.
AnalysisAI
Unauthorized BLE command injection against the Pulsetto Vagus Nerve Stimulator firmware allows any physically proximate attacker to invoke hidden device commands without authentication or encryption, with potential to alter stimulation parameters or disrupt device operation. The firmware processes a set of undisclosed commands - never exposed through the official companion mobile application - whenever the device is powered on and advertising over BLE, presenting a zero-authentication attack surface at the radio layer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Pulsetto Vagus Nerve Stimulator must be powered on and actively advertising over BLE - this is the essential gating condition, as a powered-off device presents no BLE attack surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) reflects a coherent and plausible threat model: adjacent-network exploitation requiring no authentication, no user interaction, and no special attack conditions, yielding high integrity and availability impact on the vulnerable device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the CISA ICS Medical Advisory ICSMA-26-223-02 at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-02 for any vendor-issued firmware update; no specific patched firmware version number was confirmed in the available data and must be obtained directly from Pulsetto. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue urgent notification to clinical staff and patients regarding proximity-based attack risk; conduct audit and inventory of all deployed Pulsetto devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-912 – Hidden Functionality
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today