Vulnerabilities

CVSS

8.1 High

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Risk score

64.8

Published

2026-08-13

Status

Received

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

Weaknesses

CWE-798

Coverage 1

vulnerability

Flow Neuroscience FL-100

A critical vulnerability has been identified in Flow Neuroscience devices (FL-100 and Halo Neuroscience FL-100) due to a hard-coded credential that allows an attacker within Bluetooth range to manipulate brain stimulatio…

CISA Advisories · Aug 13, 2026 Critical

CVE-2026-18164bluetoothvulnerabilityhardcoded

All articles mentioning it

Advisories and references

• github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-...
• cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01