Hidden BLE commands can switch off a vagus nerve stimulator’s safety limits

MedDevice Cyber Staff · Aug 11 · 2 min read · Via CISA ICSMA-26-223-02

CVE-2026-18844 covers undisclosed commands in the Bluetooth Low Energy interface of the Pulsetto vagus nerve stimulator. The commands carry no authentication and no encryption, the companion app never issues them, and the firmware processes them anyway whenever the device is powered on. CISA rates it 8.1 on CVSS v3.1 and 7.2 on v4, classed as CWE-912, hidden functionality. Someone in radio range can disable electrical safety mechanisms or change stimulation output settings.

Bluetooth Low Energy peripherals expose their functions as characteristics a client can read or write, and a careful device authenticates the sensitive ones so only a paired, trusted controller can invoke them. Hidden commands are what remain when that discipline is skipped: routines the firmware honors although the official app never calls them and nothing checks who is asking. The trap is treating the companion app as the only client that will ever exist, as if an undocumented protocol's obscurity were access control.

On most gadgets that would be a privacy problem. On a device that pushes electrical stimulation into a wearer, commands that disable safety limits or rewrite the output are a physical-safety matter, bounded only by the attacker's need to be in radio range. Home wellness hardware carries the security expectations of consumer electronics while doing something to the body that is anything but casual.

Coordinated disclosure only works when someone is on the other end, and here the maker stayed silent. Silence leaves the coordinating body choosing between withholding a live warning and issuing an advisory that offers users no route to safety, which is why the notice went out with no remedy attached.

Every version is affected and there is no fix. CISA says it contacted Pulsetto and got no response, so ICSMA-26-223-02 points users at a manufacturer that has not answered. A.C. Buglione reported the flaw, reserved as a CVE on August 4 and published on August 11. An unanswered disclosure turns a firmware bug that one release could close into a permanent advisory attached to the product name.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch. CVE-2026-18844 covers undocumented BLE commands the Pulsetto firmware processes with no authentication, and CISA reported no vendor response. Keep the device powered off around untrusted people and treat any safety-limit behavior as unverified until the vendor ships authenticated firmware.

Assume no fix is coming soon. CISA contacted Pulsetto and got no response, so ICSMA-26-223-02 has no remediated version to move to.
Reduce radio exposure. Power the device down in public or shared environments, since the undocumented commands work for anyone in BLE range.
Remove undocumented command handlers. If you ship firmware, audit for debug or hidden command paths and strip them from production builds; every BLE write should require authentication.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

net_wireless ctl_therapy

Contributing

app_user_accounts use_home sys_firmware_update app_mobile net_remote_access

EMB3D

PID-331 PID-41 PID-4111

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-18844 in the Pulsetto Vagus Nerve Stimulator?

A hidden functionality flaw (CWE-912) rated 8.1 on CVSS v3.1 and 7.2 on v4. The Pulsetto firmware accepts undisclosed Bluetooth Low Energy commands that carry no authentication or encryption, which an attacker in range can use to disable electrical safety mechanisms or alter stimulation output.

Is there a patch for the Pulsetto Vagus Nerve Stimulator?

No. CISA lists all versions as affected in ICSMA-26-223-02, published August 11, 2026, and says Pulsetto did not respond when contacted. Users are directed to the manufacturer for remediation guidance.

Who reported the Pulsetto vulnerability?

A.C. Buglione reported CVE-2026-18844 to CISA. The CVE was reserved on August 4, 2026 and published alongside advisory ICSMA-26-223-02 on August 11, 2026.

← Back to Vulnerabilities