LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Missing authentication lets an attacker rewrite a cardiac wearable

MedDevice Cyber Staff · May 28 · 2 min read · Via CISA

Fourth Frontier drew ICSMA-26-148-01 for the Frontier X and Frontier X2 wearable cardiac monitors and their mobile apps. CVE-2026-5768, missing authentication for a critical function, base score 8.8. An attacker reads and writes arbitrary handle values and alters clinical readings, which on an ECG wearable is the whole product. A monitor an attacker can rewrite is a monitor that can lie to a clinician.

Fixed in Android 15.0.0 and iOS 25.0.0, though the X2 was listed as all-versions affected. Shakir Zari and Jerin Sunny reported it. Consumer cardiac wearables keep arriving with the security maturity of fitness trackers and the clinical weight of diagnostic devices, and the gap between those two is where these findings live.

Remediation Desk

The Frontier X ECG wearable let arbitrary handle values be read and written without authentication, CVE covered in ICSMA-26-148-01 at CVSS 8.8, which means clinical readings could be altered. Update to the fixed app and firmware and, until then, keep pairing to trusted phones only.

Update the wearable and apps. Apply the fixed firmware and app versions from ICSMA-26-148-01.
Require authentication on every BLE handle. Read and write access to characteristics that carry clinical data must be gated behind pairing and authentication, not left open.
Limit pairing exposure. Pair only in trusted settings until updated, since an unauthenticated attacker in range can rewrite values.

Sources

CISA ↗

Questions & Answers

What is the flaw in the Frontier X ECG monitor?

The Frontier X wearable and its apps let a client read and write arbitrary handle values without authentication. In practice that means an unauthenticated party could change what the device stores or reports.

How is it rated?

CVSS 8.8 under ICSMA-26-148-01. It sits high because it combines missing authentication with the ability to write, not just read.

What is the guidance for users and the vendor?

The vendor fix is tracked in the advisory. Until it is in place, keep the device paired only to trusted phones and limit exposure of the app's interfaces.

← Back to Vulnerabilities