Hidden BLE Commands Found in Pulsetto Stimulator; Vendor Silent

CISA rarely publishes a medical device advisory without a vendor remediation section. ICSMA-26-223-02 is one of those exceptions. The advisory discloses a hidden-functionality vulnerability in all versions of the Pulsetto Vagus Nerve Stimulator, a consumer wearable that delivers electrical stimulation to the vagus nerve, and the vendor hasn't responded to coordination requests. The subtext is plain: CISA judged the patient-safety risk high enough to go public without the manufacturer's cooperation.

The vulnerability, tracked as CVE-2026-18844 and scored at CVSS 8.1, resides in the device's Bluetooth Low Energy firmware. The stimulator accepts several undisclosed BLE commands without authentication or encryption. These commands are never issued by the companion mobile application, yet the device processes them whenever it is powered on. An attacker within BLE range can disable electrical safety mechanisms or alter stimulation output settings. There's no exploit complexity to speak of: the attack requires no privileges, no user interaction, and the advisory notes the device is not exploitable remotely only because BLE's range caps at roughly 10 meters.

For healthcare organizations and patients, the operational question is immediate and grim. There is no patch. There is no mitigation from the vendor beyond an email address. CISA's recommended defensive measures don't apply cleanly to a wearable consumer device that connects directly to a smartphone over BLE. Network segmentation and firewalls are tools for infrastructure, not for something a patient wears around their neck. The advisory's boilerplate about minimizing network exposure reads almost apologetically against a vulnerability class that doesn't touch the internet at all. Clinical staff are left to weigh the therapeutic benefit of vagus-nerve stimulation against the risk that an attacker in physical proximity could disable safety features, without any guidance from the manufacturer or, so far, from FDA or medical societies.

The Pulsetto case exposes a gap that's been widening as consumer health devices cross into regulated medical territory. The device is deployed worldwide in the healthcare sector, but it's also sold direct to consumers. Its security model assumes the BLE interface is benign because the companion app is benign. That assumption collapses the moment an attacker writes their own BLE client. The fact that the hidden commands exist in firmware at all suggests they were placed there intentionally, perhaps as debugging backdoors or factory-test routines that shipped to production, but Pulsetto's silence means no one outside the company can confirm which.

This is not a story about an exotic zero-day. It's a story about a medical device whose firmware trusts every BLE command it receives, and whose maker won't say whether it plans to fix that. For organizations fielding questions from patients or clinical directors, the honest answer right now is that there isn't one.