CVE-2026-18844 Overview
CVE-2026-18844 affects the firmware of the Pulsetto Vagus Nerve Stimulator, a wearable medical device. The firmware exposes several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands lack authentication and encryption and are never issued by the companion mobile application. Any BLE peer within radio range can send them while the device is powered on. The issue is classified under CWE-912: Hidden Functionality and was published in a CISA medical device advisory.
Critical Impact
An attacker within Bluetooth range can invoke hidden firmware commands without pairing, credentials, or user interaction, compromising device integrity and availability.
Affected Products
- Pulsetto Vagus Nerve Stimulator (firmware exposing undocumented BLE commands)
Discovery Timeline
- 2026-08-11 - CVE-2026-18844 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-18844
Vulnerability Analysis
The Pulsetto stimulator exposes a BLE Generic Attribute (GATT) service that accepts commands the vendor never documented. The companion mobile application does not use these commands during normal operation. The firmware processes them unconditionally whenever the device is powered on. Because the BLE interface enforces neither authentication nor encryption, any peer within adjacent-network range can write these opcodes to the exposed characteristics.
The underlying weakness is hidden functionality [CWE-912]. Undocumented command handlers remain reachable in production firmware and provide adversary-controlled entry points that were never intended for end-user or clinician use. Full technical details are published in the CISA Medical Advisory ICSMA-26-223-02 and the accompanying CSAF advisory file.
Root Cause
The root cause is undocumented command handlers left enabled in shipping firmware, combined with the absence of BLE-layer security. The device implements no pairing requirement, no bonding, and no application-layer authentication on the affected GATT characteristics. Any BLE client that can enumerate the service can write command payloads that the firmware executes.
Attack Vector
Exploitation requires BLE radio proximity to the powered-on device. An attacker uses a standard BLE stack to connect, enumerate the GATT database, and write to the writable characteristics that handle the hidden opcodes. No pairing prompt, PIN entry, or user interaction on the device or the companion application is required. Successful command delivery can alter device behavior in ways not intended by the manufacturer, impacting the integrity and availability of the stimulator's operation.
No public proof-of-concept exploit code has been released. Refer to the CISA advisory for technical particulars.
Detection Methods for CVE-2026-18844
Indicators of Compromise
- Unexpected BLE GATT write operations to Pulsetto device characteristics originating from clients other than the official companion application.
- Device state changes (stimulation start, stop, parameter modification, or unexpected reboot) that were not initiated through the mobile application.
- Presence of unknown BLE central devices persistently connecting to the stimulator while it is powered on.
Detection Strategies
- Capture BLE traffic in the vicinity of the device with a BLE sniffer and inspect writes to non-standard characteristic UUIDs against the documented command set used by the vendor application.
- Correlate unexplained changes in device state or battery consumption with periods of active BLE connections from unrecognized peers.
- In clinical or enterprise environments, use wireless intrusion detection platforms with BLE visibility to flag unauthorized central-role devices attempting connections to known medical device MAC address ranges.
Monitoring Recommendations
- Maintain an inventory of authorized companion-application hosts and their BLE MAC addresses to establish a baseline for expected connections.
- Log and review connection attempts and GATT operations when BLE monitoring tooling is available in the deployment environment.
- Track vendor and CISA advisories for updated firmware and revised indicator lists tied to ICSMA-26-223-02.
How to Mitigate CVE-2026-18844
Immediate Actions Required
- Power off the stimulator when it is not in active use to eliminate the BLE attack surface.
- Operate the device only in physically controlled environments where untrusted BLE peers are unlikely to be within range (approximately 10 meters for typical BLE Class 2 radios).
- Consult the CISA Medical Advisory ICSMA-26-223-02 for vendor guidance and any firmware update availability.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Monitor the CISA advisory and Pulsetto vendor channels for firmware releases that remove or authenticate the undisclosed BLE commands.
Workarounds
- Keep the device powered off between therapy sessions to prevent BLE command reception.
- Use the device away from public spaces and untrusted wireless environments until firmware remediation is available.
- Do not pair or interact with the device using any application other than the official Pulsetto companion application.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
