Pulsetto

Published
August 2026
Updated
August 2026
Lateral illustration of the human head and neck with the vagus nerve highlighted in yellow against the surrounding cranial nerves and brain.
Vagus Nerve (CN X)

Overview

Pulsetto is a consumer transcutaneous vagus nerve stimulator (tVNS) worn against the neck and driven by a companion mobile application over Bluetooth Low Energy (BLE). It delivers 250 µs charge-balanced pulses to the cervical vagus, alternating polarity between phases. This report documents a hidden-functionality vulnerability in the device's Bluetooth interface.

Security findings

Coordinated Vulnerability Disclosure

CWE-912 • Hidden Functionality

CWE
CWE-912
CVSS v3
8.1
CVSS v4
7.2

All versions of the Pulsetto Vagus Nerve Stimulator are affected. The device firmware accepts several undisclosed commands over its BLE interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet they are fully processed by the device whenever it is powered on.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

The vendor was contacted early about this disclosure but did not respond.

Disclosure timeline

  1. Initial vulnerability report to CNA (CISA ICS)
  2. No response from vendor; CVE entry published

External links

  1. CVE-2026-18844 (nist.gov)
  2. EUVD-2026-56936 (europa.eu)
  3. CISA ICSMA-26-223-02 (cisa.gov)

Revision history

August 2026
Initial release following public disclosure of CVE-2026-18844.