phantom-brain

PHANTOM BRAIN v0.9 ⚠️ Proyecto experimental — no para uso en producción. El análisis con IA asiste al investigador humano; no reemplaza una auditoría manual. Siempre verifica los hallazgos de forma independiente. Lo que ES y NO ES Phantom Brain ✅ Lo que ES| ❌ Lo que NO ES ---|--- Analizador...

EUVD-2026-80739

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-85104 Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-85104

CVE-2026-85104 affects the Sooma 2GEN brain stimulator. An attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters, meaning no credentials are required to alter therapy settings on the device. The vulnerability is classified with a CVSS 4.0 base score of 5...

CVE-2026-85104: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

PT-2026-93738

Name of the Vulnerable Software and Affected Versions Sooma 2GEN brain stimulator affected versions not specified Description An attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters. Recommendations At the moment, there is no information about a newer...

NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces

The rapid integration of AI into human-centred systems such as Brain-Computer Interfaces BCIs has created a poorly understood attack surface linking neural signals to physical systems. Exploits in this domain threaten cognitive autonomy, mental privacy, and physical safety, from neural data...

CVE-2026-18164

The CVE concerns Flow Neuroscience FL-100 with an undocumented hard-coded credential that bypasses authentication. The credential is shared across all device units, allowing an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state. Affected component is ...

CVE-2026-18164 Flow Neuroscience FL-100 Use of Hard-coded Credentials

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

Flow Neuroscience FL-100

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

PT-2026-71745

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-18164: Use of Hard-coded Credentials

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-16246

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2. Starting with BRAIN2 3.09, the setup no longer executes thi...

CVE-2026-16247

The CVE affects _connect.BRAIN prior to version 5.06. During setup, LogPathConfig.exe is executed and deletes/recreates %ProgramData% permissions, granting the Windows group Everyone full control instead of restricting access to %ProgramData\Bizerba_connect.BRAIN or %ProgramData\Bizerba\BCT. Star...

EUVD-2026-45903

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-16247 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-16247 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

PT-2026-61547

Name of the Vulnerable Software and Affected Versions BRAIN2 versions prior to 3.09 Description During setup, the application LogPathConfig.exe is executed, which incorrectly grants the Windows group Everyone full control over the %ProgramData% directory instead of restricting access to...

Threat Vectors and the State of the Art in Defense Methods for Security in Neurotechnology

Brain-computer interfaces BCIs are a class of diverse hardware modalities, associated software, and connected devices which are widely used in a variety of fields, including neurosurgery, biomedical data analysis, and neuroimaging. Recent years have seen rapid advancements in BCI technology, and...