Flow Neuroscience FL-100 has hard-coded credential flaw
A hard-coded credential in Flow Neuroscience FL-100 brain-stimulation devices lets nearby attackers bypass authentication via Bluetooth and alter stimulation settings.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an ICS Medical Advisory for the Flow Neuroscience FL-100 (also sold as Halo Neuroscience FL-100), a transcranial direct current stimulation device. The flaw, tracked as CVE-2026-18164 and classified under CWE-798, stems from an undocumented hard-coded credential shared across all device units that authorizes bypass of authentication. An attacker within Bluetooth range could exploit this to arbitrarily manipulate brain stimulation parameters and override built-in safety limits, posing a direct physical safety risk to patients using the device.
The vulnerability is not remotely exploitable and requires physical proximity within Bluetooth range, limiting the attack surface to close-proximity scenarios. CISA states no known public exploitation has been reported at this time. The affected products are deployed worldwide, with the manufacturer headquartered in Sweden, and the advisory falls under the Healthcare and Public Health critical infrastructure sector.
Flow Neuroscience has released firmware updates to remediate the issue, distributed via the Flow companion app, and users are encouraged to update immediately. CISA's standard ICS mitigation guidance (network isolation, avoiding internet exposure, VPN use with caution, and phishing awareness) is provided as general defense-in-depth advice, though the Bluetooth-proximity nature of this specific flaw limits the relevance of network-based mitigations.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs