CVE-2026-85104: Sooma 2GEN Brain Stimulator Auth Bypass

CVE-2026-85104 Overview

CVE-2026-85104 affects the Sooma 2GEN brain stimulator, a medical device used for transcranial direct current stimulation (tDCS) therapy. An attacker within Bluetooth range can modify brain stimulation parameters without authentication. The vulnerability is classified under [CWE-924] (Improper Enforcement of Message Integrity During Transmission in a Communication Channel). The device accepts stimulation parameter changes over its wireless interface without validating the identity of the sender or the integrity of the message. This exposes patients to unauthorized modification of therapeutic settings by any adversary within radio proximity.

Critical Impact
An unauthenticated attacker within Bluetooth range can alter brain stimulation parameters on a patient-worn medical device, affecting therapy integrity and patient safety.

Affected Products

Sooma 2GEN brain stimulator
Devices using the Bluetooth control channel for stimulation parameter configuration
See the Sooma Medical Product Catalog for product listings

Discovery Timeline

2026-09-16 - CVE-2026-85104 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85104

Vulnerability Analysis

The Sooma 2GEN brain stimulator exposes a Bluetooth interface used to configure and control stimulation parameters. The device fails to authenticate commands issued over this channel. An attacker within radio range can send crafted messages that the device accepts as legitimate. Because the target is a therapeutic device that applies electrical current to the patient's brain, unauthorized parameter modification directly affects patient safety and treatment outcomes.

The issue maps to [CWE-924], where the communication channel does not enforce message integrity. This weakness class includes missing authentication, missing message signing, and lack of session binding between the paired controller and the device.

Root Cause

The root cause is the absence of authenticated integrity controls on the Bluetooth command interface. Stimulation parameter writes are processed without verifying that the request originates from an authorized controller. The vulnerability requires no privileges, no user interaction, and no prior pairing knowledge to exploit.

Attack Vector

Exploitation requires adjacent-network access. An attacker must be within Bluetooth radio range of the target device, typically a few meters depending on the radio class and environment. The adversary then transmits crafted Bluetooth traffic to inject or modify stimulation parameters. No credentials are required and no user interaction on the patient side is needed.

No public proof-of-concept code has been published. The vulnerability is described in prose in the advisory linked in the Sooma Medical Product Catalog references. Technical exploitation details are not available in the public record.

Detection Methods for CVE-2026-85104

Indicators of Compromise

Unexpected changes to stimulation parameters recorded in device or clinician logs
Unpaired or unknown Bluetooth peers appearing in device connection history
Therapy sessions with parameter values outside prescribed clinician-defined ranges

Detection Strategies

Review device audit logs after every session and compare applied parameters to the clinician-prescribed protocol
Monitor for anomalous Bluetooth Low Energy (BLE) activity in clinical environments using wireless intrusion detection sensors
Correlate device state changes with the physical presence of authorized operators and paired controllers

Monitoring Recommendations

Deploy BLE monitoring in treatment rooms and patient home environments to capture connection attempts from unknown MAC addresses
Enable and centrally collect device telemetry where the vendor supports it, including pairing events and parameter write operations
Establish a baseline of expected controller identifiers and alert on deviations

How to Mitigate CVE-2026-85104

Immediate Actions Required

Contact Sooma Medical for the current advisory status and firmware update availability
Restrict use of affected devices to controlled environments where Bluetooth range can be limited
Instruct clinicians and patients to power off the device when not actively in use for therapy
Verify prescribed stimulation parameters before and after each session

Patch Information

No vendor patch information is listed in the NVD entry at the time of publication. Consult the vendor directly using the contact information available through the Sooma Medical Product Catalog for firmware update guidance and coordinated disclosure updates.

Workarounds

Operate the device only in environments where unauthorized individuals cannot approach within Bluetooth range during active sessions
Disable or unpair the Bluetooth interface between prescribed sessions where the device supports doing so
Maintain physical custody of the paired controller and treat it as a security-sensitive token
Log and review all therapy session parameters against the clinician-approved protocol

bash

# No vendor-supplied configuration mitigation is available.
# Refer to Sooma Medical documentation for device management guidance.