Flow Neuroscience FL-100

{"#HardcodedCredentialsVulnerability":["The Flow Neuroscience FL-100 device uses a hard-coded credential that can be exploited by attackers within Bluetooth range, allowing them to manipulate brain stimulation parameters and override safety limits. This vulnerability is rated as HIGH in the Common Vulnerabilities and Exposures (CVE) system.","According to CISA, this vulnerability affects all versions of the Flow Neuroscience FL-100 device, including the Halo Neuroscience FL-100 version. The CVSS v3 base score for this vulnerability is 8.1, indicating a high severity level.","The hard-coded credential used by these devices can be bypassed through authentication, enabling attackers to perform unauthorized actions on the affected systems."],"#VendorResponse":["Flow Neuroscience has acknowledged the vulnerability and provided guidance on how users should mitigate it. Users are encouraged to install the latest firmware updates via the Flow app.","CISA recommends that organizations take defensive measures to minimize the risk of exploitation, such as isolating control system networks from business networks and using more secure remote access methods like Virtual Private Networks (VPNs).","The ICS webpage on cisa.gov/ics provides additional mitigation guidance and recommended practices for controlling systems security. Organizations should also follow established internal procedures when observing suspected malicious activity."],"#ImpactAnalysis":["If exploited, this vulnerability could allow attackers to manipulate brain stimulation parameters and override safety limits, potentially leading to serious health consequences.","The CVSS v4 base score of 7.2 further emphasizes the severity of this vulnerability, indicating that it is a significant risk to affected systems.","CISA recommends organizations perform proper impact analysis and risk assessment prior to deploying defensive measures against such vulnerabilities."]}