Pulsetto Stimulator CVE-2026-18844

The Pulsetto Vagus Nerve Stimulator must be powered on and actively advertising over BLE - this is the essential gating condition, as a powered-off device presents no BLE attack surface. The attacker must be within BLE radio range of the device, typically up to 10 meters under standard conditions (potentially extended with directional antenna hardware). No authentication, pairing, bonding, or prior interaction with the device is required; the hidden commands are processed unconditionally by the firmware regardless of whether the sending peer is the registered companion application. No non-default device configuration is necessary - the vulnerability is present in the device's default powered-on operational mode. Exploitation is strictly bounded by physical proximity (CVSS AV:A), ruling out remote internet-based attacks; the threat actor must be in the same physical environment as the patient or device.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) reflects a coherent and plausible threat model: adjacent-network exploitation requiring no authentication, no user interaction, and no special attack conditions, yielding high integrity and availability impact on the vulnerable device. The adjacent vector (AV:A) is the primary constraint, requiring the attacker to be within BLE radio range - this eliminates broad internet-scale exploitation but is an entirely realistic condition in hospitals, waiting rooms, rehabilitation centers, or any public space where patients use the device. No EPSS score was available in the source data, and the device is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the complete absence of authentication on a medical device command interface means that even a mid-sized rehabilitation clinic in malbork should treat this as an urgent patient-safety priority, not merely a cybersecurity housekeeping item. The NVD tag of 'Information Disclosure' appears inconsistent with the VI:H/VA:H scoring and the hidden-command nature of the flaw - the integrity and availability impacts are treated as authoritative based on the CVSS vector from the CISA advisory.

An attacker with a BLE-capable laptop or smartphone - or a purpose-built BLE tool - positions themselves within approximately 10 meters of a patient wearing a powered-on Pulsetto Vagus Nerve Stimulator, scans for its BLE advertisement, and issues one or more of the undisclosed firmware commands without any pairing, bonding, or authentication step. This could trigger unintended nerve stimulation cycles, modify therapy parameters, or halt device operation, all without any visible indication to the patient or clinical staff. No public exploit code or proof-of-concept has been identified at time of analysis, but the attack requires only standard BLE tooling available in any security researcher's or attacker's toolkit.