Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
Pulsetto is a wearable vagus nerve stimulator controlled by a companion app over Bluetooth Low Energy. CISA's advisory covers one vulnerability in the Pulsetto Lite firmware, version 1.1.8.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-18844 | The firmware accepts several undisclosed commands over BLE. They're sent without authentication or encryption, are never issued by the app, and are fully processed by the device when it's powered on (CWE-912) | Tampering, Elevation of privilege | Medium | High |
The published vector needs no privileges and no user action, but the attacker has to be within Bluetooth range, not on a network. That's why Exploitability reads Medium. Integrity and availability impacts are High. On Blue Goat's security matrix, that's High as published.
The published vectors describe the product as CISA scored it, not your device. If you build on this product or a similar component, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
| Severity from your hazard analysis | Safety risk at Medium exploitability |
|---|---|
| Negligible | Low |
| Minor or Serious | Medium |
| Critical or Catastrophic | High |
A stimulator that processes commands its own app never sends is a device whose behavior can be changed by anyone in range. For any device that delivers energy to a patient, hidden command paths belong in the threat model.
What to check now
- Inventory every command your device firmware accepts, and confirm each one is documented, needed, and authenticated. Undocumented debug or factory commands are a common source of this class of issue.
- Check BLE pairing and encryption on every characteristic that changes device behavior.
- For Pulsetto devices specifically, firmware v1.2.0 fixes the issue. It ships on units made since June 2026 and is available to devices in the field as an over-the-air update through the Pulsetto app v3.0.1.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score each affected threat in your cybersecurity risk assessment, and carry any patient-harm result into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.