| Título | OmniPEMF NeoRhythm U-BAND Missing Authentication for Critical Function |
|---|
| Descrição | RESERVED IDENTIFIER: CVE-2026-2756
This vulnerability in the OmniPEMF NeoRhythm U-BAND pulsed electromagnetic field (PEMF) device allows an attacker to perform unauthorized manipulation of neurostimulation session parameters by exploiting the absence of appropriate authentication in its Bluetooth Low Energy (BLE) implementation.
The issue stems from the lack of proper access control on the BLE interface, leaving all Generic Attribute Profile values openly accessible. Because the device does not employ BLE pairing, bonding, or authentication PINs, an attacker positioned within BLE range can directly write arbitrary values to the unprotected control channel. Furthermore, using standard widely-available targeted exploitation frameworks such as WHAD or btlejack, an attacker can seamlessly inject malicious control signals in real-time to alter active neurotherapy parameters, including electromagnetic pulse characteristics including intensity and frequency. This makes it possible to force the device to operate outside intended parameters and deliver unwanted neurostimulation directly to the user's cranium, with the potential to induce adverse neurological effects. |
|---|
| Fonte | ⚠️ https://ab3j.radio/NeoRhythm.pdf |
|---|
| Utilizador | drewbug (UID 92544) |
|---|
| Submissão | 08/03/2026 03h54 (há 7 meses) |
|---|
| Moderação | 21/03/2026 18h04 (14 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 352383 [OmniPEMF NeoRhythm até 20260308 BLE Interface Autenticação fraca] |
|---|
| Pontos | 17 |
|---|