Which versions of FL-100 are affected by EUVD-2026-58274?

Hard-coded credentials in the FL-100 transcranial brain stimulation device (Flow Neuroscience and Halo Neuroscience brands) enable unauthenticated Bluetooth remote attackers to bypass authentication…

How to fix or mitigate EUVD-2026-58274?

Within 24 hours, conduct a complete inventory of all FL-100 devices deployed in your healthcare organization and clinical facilities, classifying by setting (clinical facility vs. home use) and current patient populations receiving active therapy. Within 7 days, implement interim compensating controls including Bluetooth range restrictions where feasible, disabling remote access features if available, and applying physical access controls to deployed devices; establish continuous monitoring for unauthorized parameter changes. Within 30 days, contact Flow Neuroscience and Halo Neuroscience support to establish patch timeline expectations, develop a firmware update deployment plan accounting for device downtime requirements, and initiate device replacement procurement if patch availability extends beyond your risk tolerance window.

FL-100 EUVD-2026-58274

Q: What is the CVSS score of EUVD-2026-58274?

EUVD-2026-58274 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-18164 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-13 icscert

GHSA-97hf-8cq8-4rm3

Authentication Bypass Fl 100

7.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.2 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

AV:A for Bluetooth adjacency; PR:N as universal hard-coded credential requires no prior privileges; I:H because arbitrary manipulation of stimulation parameters constitutes direct data integrity violation.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:56 vuln.today

CVE Published

Aug 13, 2026 - 19:13 cve.org

HIGH 7.2

DescriptionCVE.org

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

AnalysisAI

Hard-coded credential exposure in the FL-100 transcranial brain stimulation device enables any attacker within Bluetooth range to bypass authentication entirely and manipulate neurostimulation parameters across every deployed unit simultaneously. The credential is universally shared across all FL-100 devices manufactured under both the Flow Neuroscience and Halo Neuroscience brands, meaning a single credential disclosure event compromises the entire installed base at once. No public exploit code has been identified at time of analysis and active exploitation is not confirmed by CISA KEV, but the zero-privilege, zero-complexity authentication bypass presents a credible patient safety risk in clinical and home-use therapeutic environments.

Technical ContextAI

The FL-100 is a transcranial direct current stimulation (tDCS) device used for brain stimulation therapy, marketed under both the Flow Neuroscience and Halo Neuroscience brands per CPE strings cpe:2.3:a:flow_neuroscience:fl-100:*:*:*:*:*:*:*:* and cpe:2.3:a:halo_neuroscience:fl-100:*:*:*:*:*:*:*:*. The device communicates over Bluetooth, which serves as the primary attack surface. CWE-798 (Use of Hard-coded Credentials) identifies the root cause: firmware embeds a static credential identical across all manufactured units that operators and end users cannot modify or rotate. Because this credential is explicitly authorized to bypass authentication, it functions as a universal master key for the entire device class rather than a single unit. The CVSS 4.0 vector AV:A confirms Bluetooth adjacency as the attack vector, and PR:N confirms no prior credentials beyond the embedded one are needed. CISA ICS-CERT classified this under a medical device advisory (ICSMA-26-225-01), reflecting the patient safety dimension inherent in unauthorized control of active neurostimulation.

RemediationAI

No patched firmware version is confirmed in the available data - CPE wildcard version fields indicate all versions remain affected, and the advisory references do not specify a fixed release. Operators should consult the CISA ICS-CERT advisory directly at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01 and contact Flow Neuroscience and Halo Neuroscience immediately for firmware update availability and timelines. As interim compensating controls, restrict physical access to therapy areas where FL-100 devices are in use to minimize the Bluetooth exposure window, since Bluetooth adjacency (typically 10-100 meters) is the sole constraint on the attack vector. Powering off devices when not in active therapeutic use eliminates the Bluetooth attack surface entirely during idle periods, though this introduces operational friction in continuous-monitoring use cases. Supervisory clinical presence during all therapy sessions reduces the likelihood of undetected parameter manipulation. None of these controls eliminate the underlying hard-coded credential and must not be treated as permanent mitigations pending a vendor-issued firmware fix.