Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits.
The following versions of Flow Neuroscience FL-100 are affected:
Flow Neuroscience FL-100
Halo Neuroscience FL-100
Vendor
Equipment
Flow Neuroscience
Flow Neuroscience FL-100
Use of Hard-coded Credentials
Critical Infrastructure Sectors: Healthcare and Public Health
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Sweden
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarilymanipulate brain stimulation parameters and state.