hidden functionality

CISA ICS Medical Advisory ICSMA-26-223-02 discloses CVE-2026-18844, a hidden functionality vulnerability (CWE-912) in all versions of the Pulsetto Vagus Nerve Stimulator. The device firmware processes undocumented Bluetooth Low Energy commands that are sent without authentication or encryption and are never issued by the companion mobile application. An attacker within BLE range could exploit these commands to disable electrical safety mechanisms or alter stimulation parameters, creating a patient safety risk. The vendor has not responded to CISA coordination efforts.