Security Advisory

CVE-2026-18164: Flow Neuroscience FL-100 Hard-Coded BLE Credential Lets Attacker Alter Brain Stimulation (pending)

Last updated:
  • CVE-2026-18164
Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2026-18164 is a hard-coded credential flaw (CWE-798) in the Flow Neuroscience FL-100 home tDCS brain-stimulation device: a credential shared by every unit bypasses authentication, letting an attacker within Bluetooth range arbitrarily change stimulation parameters and override safety limits; NVD has not finished its own severity analysis.

Vulnerability summary

N/A

Not yet scored

0.4%

EPSS score (FIRST)

No

CISA KEV catalog

2026-08-13

Published

Vulnerability ID: CVE-2026-18164 · Source: NVD (CISA ICS-CERT Secondary score only, not NVD Primary; vulnStatus: Deferred)

Affected components

ComponentCPEVersion range
Flow Neuroscience FL-100 (tDCS brain-stimulation device)—All units with firmware before July 2026
Halo Neuroscience FL-100 (rebadged tDCS brain-stimulation device)—All units with firmware before July 2026

What does this mean for affected devices?

CVE-2026-18164 is a Use of Hard-coded Credentials vulnerability (CWE-798) in the Flow Neuroscience FL-100, a consumer transcranial direct current stimulation (tDCS) headset marketed for at-home depression treatment and also sold as the Halo Neuroscience FL-100. NVD's description states: "An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state" (NVD).

NVD tracks CVE-2026-18164 with status "Deferred" as of 2026-10-31: the only scores on record are CISA ICS-CERT's own Secondary submissions — CVSS v3.1 8.1 (high), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, and CVSS v4.0 7.2 (high), vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N — both attributed to source [email protected] and typed Secondary, not an NVD-published Primary rating, so this page does not show a headline severity score rather than presenting either figure as NVD-confirmed (NVD).

CISA's medical-device advisory ICSMA-26-225-01, published 2026-08-13, states that "successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits," affects the Healthcare and Public Health sector worldwide, lists Flow Neuroscience as headquartered in Sweden, and credits researcher A.C. Buglione with the finding. The advisory notes the vulnerability "is not exploitable remotely" — the attacker must be within Bluetooth range of the headset — and that no known public exploitation has been reported (CISA ICS Medical Advisory ICSMA-26-225-01).

Flow Neuroscience's remediation, per the CISA advisory, is for users to install the latest firmware update distributed through the Flow companion app; the fix shipped in firmware dated July 2026, before which all units are affected (CISA ICS Medical Advisory ICSMA-26-225-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30, and FIRST scores the probability of exploitation at 0.00388 (33.0th percentile) as of 2026-10-31 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. FL-100 owners should update the headset's firmware through the Flow app and avoid using the device while unknown Bluetooth devices are paired nearby.

How to fix this class of issueThis advisory's weakness class is Hard-coded credentials. Our practical guide covers how to detect, fix, verify and disclose it: How to fix hard-coded credentials in embedded firmware.

Evidence

  • An undocumented hard-coded credential shared by all FL-100 device units bypasses authentication, letting an attacker within Bluetooth range arbitrarily manipulate brain stimulation parameters and state (CWE-798). — NVD
  • NVD status is "Deferred"; only CISA ICS-CERT Secondary scores exist — CVSS v3.1 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and CVSS v4.0 7.2 (high) — no NVD Primary score published. — NVD
  • Advisory ICSMA-26-225-01 affects Healthcare and Public Health worldwide, Flow Neuroscience headquartered in Sweden, not remotely exploitable (Bluetooth range only); reported by A.C. Buglione; no known public exploitation. — CISA ICS Medical Advisory ICSMA-26-225-01
  • Fix is to install the latest firmware via the Flow companion app; patched firmware dates from July 2026, before which all units are affected. — CISA ICS Medical Advisory ICSMA-26-225-01
  • Not present in the CISA KEV catalog as of 2026-10-30; EPSS score is 0.00388 (33.0th percentile) as of 2026-10-31. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2026-20316: Cisco Secure FMC Static Credential Login (KEV, ransomware) — CVSS 5.3, Medium severityCISA KEVCVE-2026-20316: KEV hard-coded low-privileged account in Cisco Secure Firewall Management Center, exploited in ransomware activity. No workaround. Sourced to NVD, CISA and Cisco.CVE-2026-22769: Dell RecoverPoint for VMs Hard-Coded Credential RCE — CVSS 10, Critical severityCISA KEVCVE-2026-22769: KEV hard-coded Tomcat credential in Dell RecoverPoint for Virtual Machines gives root-level persistence. Versions, UNC6201 exploitation, scoring, sourced to NVD, CISA and Dell.CVE-2026-27873: Johnson Controls EasyIO FG Hard-Coded Creds (pending)CVE-2026-27873: hard-coded credentials in the Johnson Controls EasyIO FG building controller enable password spraying, no firmware fix available. NVD has not yet completed its analysis.

Sources

  1. NVD
  2. CISA ICS Medical Advisory ICSMA-26-225-01
  3. CISA KEV
  4. FIRST EPSS