Flow Neuroscience FL-100 ships a shared Bluetooth credential in every unit

MedDevice Cyber Staff · 3 days ago · 2 min read · Via CISA advisory ICSMA-26-225-01

Mindfield Biosystems / Unsplash

CISA advisory ICSMA-26-225-01, released August 13, describes an undocumented credential hardcoded into the Flow Neuroscience FL-100 and shared by every unit shipped. The FL-100 is a transcranial direct current stimulation headset for major depressive disorder, worn at home. An attacker in Bluetooth range who knows the credential bypasses authentication and changes stimulation parameters and device state. The flaw is CVE-2026-18164, CWE-798, scored 8.1 on CVSS v3.1 and 7.2 on v4.

The timing stings. FDA cleared the FL-100 in late 2025 as the first at-home brain stimulation treatment for depression on the US market, and US availability began in the second quarter of 2026. Firmware released before July 2026 is affected, and NVD lists the Halo Neuroscience FL-100 under the same CVE. Flow Neuroscience ships the fix as a firmware update through the Flow companion app. A.C. Buglione reported the flaw to CISA.

The vector is adjacent, so exposure ends at Bluetooth range, and confidentiality impact is none. Integrity and availability are both rated high, on a device that drives current into a patient's head. Per-unit pairing secrets are the minimum for hardware in this class, and they cost close to nothing at manufacturing time.

Remediation Desk

Update the FL-100 through the Flow app to the July 2026 firmware or later, which replaces the shared Bluetooth credential addressed in CVE-2026-18164. Until a unit is updated, keep it powered off in shared or public spaces, since anyone in Bluetooth range can reach the stimulation parameters.

Force the firmware update. CVE-2026-18164 is fixed in the July 2026 firmware delivered through the Flow app. Confirm the version on each device rather than assuming the push landed.
Treat pre-update units as exposed. A shared credential means one extracted key works against every unit, so limit Bluetooth range exposure until the update is confirmed.
Move to per-device secrets. If you build BLE devices, provision a unique key or pairing secret per unit at manufacture so one recovered credential never unlocks the fleet.

Questions & Answers

What is CVE-2026-18164 in the Flow Neuroscience FL-100?

It is an undocumented hardcoded credential shared by every FL-100 unit, classed CWE-798 and scored 8.1 on CVSS v3.1 and 7.2 on v4. An attacker within Bluetooth range can bypass authentication and change stimulation parameters and device state. CISA published it as ICSMA-26-225-01 on August 13, 2026.

Is there a patch for the Flow Neuroscience FL-100 hardcoded credential?

Yes. Firmware released before July 2026 is affected, and Flow Neuroscience distributes updated firmware through the Flow companion app. CISA advises users to install the latest update.

Can an attacker change brain stimulation settings on the Flow FL-100 headset?

Yes, within Bluetooth range. CVE-2026-18164 lets a nearby attacker authenticate with the shared credential and manipulate transcranial direct current stimulation parameters. The CVSS vector rates integrity and availability impact high, with no data exposure.

← Back to Vulnerabilities