Sooma Duo

Published
September 2026
Updated
September 2026

Overview

Sooma 2GEN is a transcranial direct current stimulation (tDCS) brain stimulator configured via a companion application over Bluetooth.

Security findings

Coordinated Vulnerability Disclosure

CWE-924 • Improper Enforcement of Message Integrity

CWE
CWE-924
CVSS v4
5.3

The Sooma 2GEN brain stimulator uses only a cyclic redundancy check (CRC) to validate messages received over its Bluetooth communication channel. This allows an attacker within Bluetooth range to make unauthenticated changes to brain stimulation parameters, including increasing current by 200% or changing electrode output from direct-current (DC) to alternating-current (AC) stimulation at different frequencies.

Disclosure timeline

  1. Initial vulnerability report to CNA (NCSC-FI)
  2. CVE entry published

External links

  1. CVE-2026-85104 (nist.gov)
  2. EUVD-2026-80739 (europa.eu)

Revision history

September 2026
Initial release following public disclosure of CVE-2026-85104.