Pulsetto Vagus Nerve Stimulator
Pulsetto Vagus Nerve Stimulator firmware vulnerability allows disabling safety mechanisms via hidden commands.
A critical vulnerability (CVE-2026-18844) has been identified in the Pulsetto Vagus Nerve Stimulator, affecting all versions. Attackers can exploit hidden commands sent over Bluetooth Low Energy (BLE) without authentication or encryption to disable safety features or alter stimulation settings. Pulsetto has not yet provided a response to CISA regarding mitigation efforts.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Pulsetto?
Get an email when a new story names Pulsetto, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Pulsetto Vagus Nerve Stimulator exposes a critical flaw in its Bluetooth Low Energy implementation, allowing attackers to send hidden commands without any authentication or encryption. This means anyone within BLE range can disable safety features or alter stimulation settings on a patient's device, posing direct physical harm. The absence of a vendor response to CISA compounds the risk, leaving users with no official mitigation path. This case highlights how security-by-obscurity and unauthenticated wireless interfaces in medical devices create life-threatening attack surfaces.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-18844