Flow Neuroscience FL-100 ships a shared Bluetooth credential in every unit

MedDevice Cyber Staff · Aug 13 · 2 min read · Via CISA advisory ICSMA-26-225-01

CISA advisory ICSMA-26-225-01, released August 13, describes an undocumented credential hardcoded into the Flow Neuroscience FL-100 and shared by every unit shipped. The FL-100 is a transcranial direct current stimulation headset for major depressive disorder, worn at home. An attacker in Bluetooth range who knows the credential bypasses authentication and changes stimulation parameters and device state. The flaw is CVE-2026-18164, CWE-798, scored 8.1 on CVSS v3.1 and 7.2 on v4.

A hardcoded credential shared across a product line reduces the security of every unit to one secret. Because the same value lives in each device's firmware, recovering it once unlocks all of them, with no per-device isolation to contain the damage.

The consequence is unusual because the flaw touches control, not data. A stimulation headset regulates electrical current delivered to the wearer, so an intruder who alters its parameters interferes with a therapy in progress rather than reading records. Used at home, the device has no clinical staff nearby to notice trouble.

The timing stings. FDA cleared the FL-100 in late 2025 as the first at-home brain stimulation treatment for depression on the US market, and US availability began in the second quarter of 2026. Firmware released before July 2026 is affected, and NVD lists the Halo Neuroscience FL-100 under the same CVE. Flow Neuroscience ships the fix as a firmware update through the Flow companion app. A.C. Buglione reported the flaw to CISA.

The case shows how fast consumer neurotechnology is reaching patients over wireless links built for convenience. Pairing that assumes a cooperative user leaves little margin when the same interface governs a therapeutic output.

The vector is adjacent, so exposure ends at Bluetooth range, and confidentiality impact is none. Integrity and availability are both rated high, on a device that drives current into a patient's head. Per-unit pairing secrets are the minimum for hardware in this class, and they cost close to nothing at manufacturing time.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update the FL-100 through the Flow app to the July 2026 firmware or later, which replaces the shared Bluetooth credential addressed in CVE-2026-18164. Until a unit is updated, keep it powered off in shared or public spaces, since anyone in Bluetooth range can reach the stimulation parameters.

Force the firmware update. CVE-2026-18164 is fixed in the July 2026 firmware delivered through the Flow app. Confirm the version on each device rather than assuming the push landed.
Treat pre-update units as exposed. A shared credential means one extracted key works against every unit, so limit Bluetooth range exposure until the update is confirmed.
Move to per-device secrets. If you build BLE devices, provision a unique key or pairing secret per unit at manufacture so one recovered credential never unlocks the fleet.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

net_wireless

Contributing

app_user_accounts ctl_therapy use_home sys_firmware_update

EMB3D

PID-332 PID-3321

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-18164 in the Flow Neuroscience FL-100?

It is an undocumented hardcoded credential shared by every FL-100 unit, classed CWE-798 and scored 8.1 on CVSS v3.1 and 7.2 on v4. An attacker within Bluetooth range can bypass authentication and change stimulation parameters and device state. CISA published it as ICSMA-26-225-01 on August 13, 2026.

Is there a patch for the Flow Neuroscience FL-100 hardcoded credential?

Yes. Firmware released before July 2026 is affected, and Flow Neuroscience distributes updated firmware through the Flow companion app. CISA advises users to install the latest update.

Can an attacker change brain stimulation settings on the Flow FL-100 headset?

Yes, within Bluetooth range. CVE-2026-18164 lets a nearby attacker authenticate with the shared credential and manipulate transcranial direct current stimulation parameters. The CVSS vector rates integrity and availability impact high, with no data exposure.

← Back to Vulnerabilities