Attack Chain

1. Attacker performs reconnaissance within Bluetooth range of a target Pulsetto Vagus Nerve Stimulator.
2. Attacker initiates a Bluetooth Low Energy (BLE) connection to the target device.
3. Attacker identifies the handle or characteristic associated with the device's undocumented firmware command interface.
4. Attacker crafts a custom payload containing the unauthorized command strings.
5. Attacker transmits the unauthenticated command over the BLE protocol.
6. Device firmware receives and processes the unauthorized command without authentication or encryption.
7. Attacker successfully disables electrical safety mechanisms or alters stimulation output settings to impact the device operation.

Impact

The vulnerability directly impacts the Healthcare and Public Health sector, as the device is deployed worldwide for patient care. If exploited, an attacker could manipulate the therapeutic output of the stimulator, potentially causing physical harm by disabling safety mechanisms or delivering unintended levels of nerve stimulation. No known in-the-wild exploitation has been reported to CISA as of the publication date.

Recommendation

Prioritized, concrete actions for security teams managing or monitoring environments containing these devices:

• Minimize physical access to areas where these medical devices are in use by patients to reduce the likelihood of an adjacent Bluetooth attack.
• Isolate affected medical devices from critical clinical networks to prevent cross-contamination if a compromised device is used as a pivot point, although this vulnerability is currently limited to adjacent BLE access.
• Contact the vendor directly at info@pulsetto.tech to request a firmware update or remediation plan for CVE-2026-18844.
• Review site-specific security policies regarding the use of personal medical electronics in controlled facility environments.