[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiId4tu_d08zYFuksgA86veZe_8Ar5oEK7UE0hdHGZZQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"7721956d-bacc-49e2-9795-8708e76c231b","hard-coded-credentials-in-medical-brain-stimulation-device-enable-bluetooth-auth-bypass","4b2fe92b-d45b-4b12-bb07-08ebbf2c6a81","Hard-Coded Credentials in Medical Brain Stimulation Device Enable Bluetooth Auth Bypass","The FL-100 and Halo devices shipped with an undocumented, shared hard-coded credential — a fundamental design flaw that eliminates authentication as a meaningful security control. Any attacker within Bluetooth range can exploit this to manipulate brain stimulation parameters, posing direct physical harm to patients. Hard-coded credentials are especially dangerous in medical devices because they cannot be changed by end users and affect every deployed unit simultaneously. This case underscores that security-by-obscurity is not a substitute for proper credential management, and that connected medical devices carry life-safety implications far beyond typical IT assets.","**Immediate actions:**\n- Apply the vendor-issued firmware update to all FL-100 and Halo devices as soon as possible.\n- Physically restrict access to environments where affected devices operate to reduce the Bluetooth attack surface.\n- Audit your medical device inventory to identify all deployed FL-100\u002FHalo units and confirm patch status for each.\n\n**Long-term improvements:**\n- Require vendors to attest that devices contain no hard-coded or shared credentials as part of medical device procurement processes.\n- Implement a formal medical device security program aligned with FDA cybersecurity guidance to evaluate connected devices before deployment.\n- Establish network and physical segmentation policies that isolate Bluetooth-enabled medical devices from general-purpose networks.\n\n**Detection measures:**\n- Deploy Bluetooth monitoring tools in clinical environments to detect anomalous pairing or connection attempts to medical devices.\n- Subscribe to CISA ICS-CERT and relevant medical device vendor advisories to receive timely vulnerability notifications.\n- Conduct periodic vulnerability assessments specifically targeting IoMT (Internet of Medical Things) assets in your environment.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 IA-5: Authenticator Management (prohibition of default\u002Fshared credentials)","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-8: Transmission Confidentiality and Integrity","NIST Cybersecurity Framework: PR.AC-1, PR.IP-1","FDA Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (2023)","IEC 62443-4-2: Security for Industrial Automation and Control Systems — Component Security Requirements","GDPR Article 32: Security of Processing (where patient data may be involved)","HIPAA Security Rule 45 CFR §164.312(a)(2)(i): Unique User Identification","CISA ICS-CERT Advisory Best Practices: Network Isolation for Critical Medical Devices",{},"published","2026-08-13T19:21:36.935845+00:00","2026-08-13T19:21:36.644+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-medical-advisories\u002Ficsma-26-225-01","flow-neuroscience-fl-100-cf3bb9","Flow Neuroscience FL-100",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[53,56,60],{"slug":48,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":61,"name":62,"problem":63},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]