Critical Hard-Coded Credential Vulnerability in Flow Neuroscience FL-100 Brain Stimulation Devices

A critical vulnerability discovered in Flow Neuroscience FL-100 and Halo Neuroscience FL-100 brain stimulation devices could allow attackers within Bluetooth range to manipulate medical treatment parameters. According to a CISA Industrial Control System Medical Advisory (ICSMA-26-225-01) published on August 13, 2026, an undocumented hard-coded credential shared by all device units enables bypass of authentication mechanisms.

The vulnerability, tracked as CVE-2026-18164, has a CVSS v3 base score of 8.1 (HIGH). The attack vector is adjacent (AV:A), with low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), with impacts limited to integrity and availability (I:H, A:H).

The affected firmware versions include Flow Neuroscience FL-100 and Halo Neuroscience FL-100 units shipped with firmware prior to July 2026. The relevant CWE classification is CWE-798 (Use of Hard-coded Credentials).

CISA notes that no public exploitation of this vulnerability has been reported to date. The attacker must be within Bluetooth range of the target device. Exploitation could allow manipulation of brain stimulation parameters and the overriding of safety limits, which presents direct health risks to users undergoing treatment.

Flow Neuroscience has encouraged users to install the latest firmware updates via the Flow app to mitigate the issue. CISA recommends minimizing network exposure for all control system devices, locating devices behind firewalls, and isolating them from business networks when remote access is required.