Flow Neuroscience FL-100
Flow Neuroscience FL-100 devices have a hard-coded credential vulnerability.
A critical vulnerability (CVE-2026-18164) has been identified in Flow Neuroscience's FL-100 and Halo devices, allowing attackers within Bluetooth range to bypass authentication and manipulate brain stimulation parameters. The issue stems from an undocumented, shared hard-coded credential. While not remotely exploitable, CISA recommends immediate firmware updates and network isolation for affected devices, which are deployed worldwide in the healthcare sector.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Flow Neuroscience?
Get an email when a new story names Flow Neuroscience, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe FL-100 and Halo devices shipped with an undocumented, shared hard-coded credential — a fundamental design flaw that eliminates authentication as a meaningful security control. Any attacker within Bluetooth range can exploit this to manipulate brain stimulation parameters, posing direct physical harm to patients. Hard-coded credentials are especially dangerous in medical devices because they cannot be changed by end users and affect every deployed unit simultaneously. This case underscores that security-by-obscurity is not a substitute for proper credential management, and that connected medical devices carry life-safety implications far beyond typical IT assets.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-18164