Fl 100
Monthly
Hard-coded credential exposure in the FL-100 transcranial brain stimulation device enables any attacker within Bluetooth range to bypass authentication entirely and manipulate neurostimulation parameters across every deployed unit simultaneously. The credential is universally shared across all FL-100 devices manufactured under both the Flow Neuroscience and Halo Neuroscience brands, meaning a single credential disclosure event compromises the entire installed base at once. No public exploit code has been identified at time of analysis and active exploitation is not confirmed by CISA KEV, but the zero-privilege, zero-complexity authentication bypass presents a credible patient safety risk in clinical and home-use therapeutic environments.
Hard-coded credential exposure in the FL-100 transcranial brain stimulation device enables any attacker within Bluetooth range to bypass authentication entirely and manipulate neurostimulation parameters across every deployed unit simultaneously. The credential is universally shared across all FL-100 devices manufactured under both the Flow Neuroscience and Halo Neuroscience brands, meaning a single credential disclosure event compromises the entire installed base at once. No public exploit code has been identified at time of analysis and active exploitation is not confirmed by CISA KEV, but the zero-privilege, zero-complexity authentication bypass presents a credible patient safety risk in clinical and home-use therapeutic environments.