Pulsetto

Published
August 2026
Updated
September 2026
Lateral illustration of the human head and neck with the vagus nerve highlighted in yellow against the surrounding cranial nerves and brain.
Vagus Nerve (CN X)

Overview

Pulsetto is a consumer transcutaneous vagus nerve stimulator (tVNS) worn against the neck and driven by a companion mobile application over Bluetooth Low Energy (BLE). It delivers 250 µs charge-balanced pulses to the cervical vagus, alternating polarity between phases. This report documents a hidden-functionality vulnerability in the device's Bluetooth interface.

Device lineage

ProductReleased
Pulsetto LiteJuly 2022
Pulsetto FITJuly 2025

Research output

Vagus Nerve Stimulation Waveforms - PulseLibre Recordings

doi:10.17605/osf.io/29dny

Security findings

Coordinated Vulnerability Disclosure

CWE-912 • Hidden Functionality

CWE
CWE-912
CVSS v3
8.1
CVSS v4
7.2

All versions of the Pulsetto Vagus Nerve Stimulator are affected. The device firmware accepts several undisclosed commands over its BLE interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet they are fully processed by the device whenever it is powered on.

Pulsetto released a firmware fix; affected users should update through the companion mobile application.

Disclosure timeline

  1. Initial vulnerability report to CNA (CISA ICS)
  2. CVE entry / advisory published
  3. Vendor released a firmware fix

External links

  1. CVE-2026-18844 (nist.gov)
  2. EUVD-2026-56936 (europa.eu)
  3. CISA ICSMA-26-223-02 (cisa.gov)

Revision history

August 2026
Initial release following public disclosure of CVE-2026-18844.
September 2026
Updated to reflect the vendor's firmware fix for CVE-2026-18844.