| عنوان | OmniPEMF NeoRhythm U-BAND Missing Authentication for Critical Function |
|---|
| الوصف | RESERVED IDENTIFIER: CVE-2026-2756
This vulnerability in the OmniPEMF NeoRhythm U-BAND pulsed electromagnetic field (PEMF) device allows an attacker to perform unauthorized manipulation of neurostimulation session parameters by exploiting the absence of appropriate authentication in its Bluetooth Low Energy (BLE) implementation.
The issue stems from the lack of proper access control on the BLE interface, leaving all Generic Attribute Profile values openly accessible. Because the device does not employ BLE pairing, bonding, or authentication PINs, an attacker positioned within BLE range can directly write arbitrary values to the unprotected control channel. Furthermore, using standard widely-available targeted exploitation frameworks such as WHAD or btlejack, an attacker can seamlessly inject malicious control signals in real-time to alter active neurotherapy parameters, including electromagnetic pulse characteristics including intensity and frequency. This makes it possible to force the device to operate outside intended parameters and deliver unwanted neurostimulation directly to the user's cranium, with the potential to induce adverse neurological effects. |
|---|
| المصدر | ⚠️ https://ab3j.radio/NeoRhythm.pdf |
|---|
| المستخدم | drewbug (UID 92544) |
|---|
| ارسال | 08/03/2026 03:54 AM (7 أشهر منذ) |
|---|
| الاعتدال | 21/03/2026 06:04 PM (14 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 352383 [OmniPEMF NeoRhythm حتى 20260308 BLE Interface توثيق ضعيف] |
|---|
| النقاط | 17 |
|---|