IM
IronMonkey Threat Research
‹ Back to ICS Advisories

Pulsetto Vagus Nerve Stimulator (Update A)

HIGH
CVSS 8.1
Date 2026-10-08T06:00:00+00:00
Source cisa-csaf
Published by CISA

// Description

Successful exploitation of this vulnerability could allow an attacker to use could use undocumented commands to modify certain stimulation settings.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-18844 8.1 high
The firmware of the affected product accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

// Remediations (2)

Mitigation: For assistance, users are encouraged to reach out directly to Pulsetto at [email protected].
For assistance, users are encouraged to reach out directly to Pulsetto at [email protected].
Mitigation: Pulsetto released firmware v1.2.0 in May 2026, and units manufactured since June 2026 ship with the
Pulsetto released firmware v1.2.0 in May 2026, and units manufactured since June 2026 ship with the new version. For devices in the field, an over-the-air update to v1.2.0 has been released and is available through the Pulsetto app v3.0.1. Users are prompted to update their device firmware when connecting to the app.

// References