Loading vulnerability…
Unauthenticated BLE Hidden Command Processing in Pulsetto Vagus Nerve Stimulator Firmware
CVE-2026-18844 is a high-severity firmware vulnerability in the Pulsetto Vagus Nerve Stimulator. The device firmware accepts several undocumented Bluetooth Low Energy commands that are not used by the companion mobile application, yet are fully processed by the device whenever it is powered on. These commands can be sent without authentication or encryption, exposing a hidden command interface over BLE to any nearby attacker. The issue affects all current firmware versions. The weakness enables unauthorized control over device behavior through undocumented functionality that should not be reachable without proper access control and transport protection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker in Bluetooth range to issue unauthorized commands to the powered-on device, potentially disabling electrical safety mechanisms or altering stimulation output settings. This creates high integrity and availability impact by enabling unintended device behavior and unsafe modification of therapeutic operation. No confidentiality impact has been reported.
If you can’t patch tonight, do this now.
Until an official fix is available, reduce exposure by limiting physical proximity of untrusted individuals to powered-on devices, disabling or avoiding use of the device in untrusted environments where nearby BLE access is possible, and following any vendor guidance for secure operation. Operational controls should focus on preventing unauthorized adjacent-network Bluetooth access to the device while it is powered on.
Patch, then assume compromise.
No vendor remediation details are currently available. Users should contact the vendor directly for official remediation information. If a firmware update or product advisory becomes available, affected devices should be updated promptly across all deployed units because all current firmware versions are reported as affected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.