One credential, every unit: CISA flags safety-limit bypass on Flow Neuroscience FL-100

CISA published an advisory on 13 August 2026 covering the Flow Neuroscience FL-100, a brain stimulation device deployed worldwide by a vendor headquartered in Sweden ^[1][3]. The finding is an undocumented hard-coded credential, shared by all device units, that is authorised to bypass authentication, letting an attacker within Bluetooth range arbitrarily manipulate stimulation parameters and state and override safety limits ^[2][4].

That combination is what separates this from the usual run of medical-device firmware bugs. The credential is not per-device, so recovering it once from a single unit generalises to every unit in the field, and there is no per-target work left to do ^[15]. The classification CISA assigned, CWE-798, use of hard-coded credentials, is one of the oldest entries in the catalogue ^[7]. What is unusual is the output: not data exfiltration or a denial of service, but the electrical parameters applied to a person's head, with the manufacturer's own guardrails removed ^[4].

The scoping in the advisory is loose in a way that matters to anyone trying to act on it. Affected products are listed under two brandings, Flow Neuroscience FL-100 and Halo Neuroscience FL-100, and affected versions are given as anything before July 2026 rather than as build numbers ^[5][6]. A date threshold instead of a firmware version leaves the user without a clean way to check what they are running ^[16]. The advisory as published also carries a Metrics heading with no CVSS score and no CVE identifier attached, and its revision history shows a single entry, the initial release ^[13][14].

The stated mitigation is for users to install the latest firmware provided by Flow Neuroscience via the Flow app ^[9]. That places remediation in the hands of individual end users acting through a consumer phone application, which is a slower and less observable path than a clinical fleet update ^[17]. CISA's recommended defensive measures, filed under the Healthcare and Public Health sector, are the standard industrial control system set: minimise network exposure, keep devices off the internet, put them behind firewalls, isolate them from business networks, and use VPNs for remote access ^[11][12]. None of that reaches a Bluetooth proximity attack on a device worn on a person, which is the actual exposure here ^[18].

The mitigating facts, such as they are: CISA says the vulnerability is not exploitable remotely, and no known public exploitation specifically targeting it has been reported to the agency ^[10]. Proximity is a real constraint. It is not much of one for a device used at home, in an office, or anywhere within radio range of a stranger. The vulnerability was reported to CISA by A.C. Buglione ^[8].