CVE-2026-18844 reveals undisclosed BLE command handlers in the Pulsetto vagus nerve stimulator firmware — functions the companion app never invokes but the device still processes. The vulnerability isn't a typical implementation bug; it's a design assumption failure where developers treated 'we don't call this from our app' as equivalent to 'no one can reach this.' In reality, BLE packets are trivial to capture and inject with $50 hardware, and the absence of an official API call path tells a sniffer nothing about what the firmware will accept.
This is a 'dark API' artifact: debug interfaces, factory test modes, and disabled feature branches that persist in production firmware because 'removal was planned for later' became 'removal never happened.' The handlers accumulated across development sprints, survived the transition to production, and were never flagged because no one asked the attack surface question: 'What happens if someone sends raw BLE packets containing command IDs we never generate from our app?'
The blast radius here differs fundamentally from a smart lightbulb or fitness tracker. The Pulsetto directly influences human physiology through vagus nerve stimulation. An attacker who reaches the BLE interface isn't toggling a setting — they're modifying stimulation parameters on a device wired to someone's nervous system. The clinical deployment context compounds this: devices are used in waiting rooms, group therapy settings, and hospitals where proximity is assumed but unverified. You don't need the victim to pair with a malicious device — you need to be proximate to one that never prompts for pairing anyway.
Your remediation steps: First, verify whether the current firmware version (check the device settings or BLE service advertisement) contains these undisclosed handlers by BLE sniffer analysis of your own device — compare every command ID the firmware responds to against every command ID your companion app generates. Any mismatch is a dark API candidate. Second, confirm with the vendor whether a firmware update is available and whether it removes or authenticates these handlers; if not, treat the device as having an exposed attack surface until patched. Third, audit your broader BLE device inventory for this same pattern — medical BLE devices consistently ship with undocumented command handlers because threat models are constructed around intended usage, not raw interface behavior. This is a class-level vulnerability, not a Pulsetto-specific one.