CVE-2026-2671

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2671", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-18T09:19:04.704Z", "datePublished": "2026-03-07T18:02:07.505Z", "dateUpdated": "2026-09-16T21:39:22.440Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-16T21:39:22.440Z"}, "title": "Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-319", "lang": "en", "description": "Cleartext Transmission of Sensitive Information"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-310", "lang": "en", "description": "Cryptographic Issues"}]}], "affected": [{"vendor": "Mendi", "product": "Neurofeedback Headset", "versions": [{"version": "V4", "status": "affected"}], "cpes": ["cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:*"], "modules": ["Bluetooth Low Energy Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack's complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.8, "vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-07T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-16T23:39:23.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "A. C. Buglione", "type": "finder"}, {"lang": "en", "value": "drewbug (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "drewbug (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/349702", "name": "VDB-349702 | Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/349702/cti", "name": "VDB-349702 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-2671", "name": "CVE-2026-2671 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/766457", "name": "Submit #766457 | Mendi Innovation AB Mendi V4 Cleartext Transmission of Sensitive Information", "tags": ["third-party-advisory"]}, {"url": "https://doi.org/10.22541/au.177196231.16660369/v1", "tags": ["broken-link"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T16:13:09.755986Z", "id": "CVE-2026-2671", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T16:28:55.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2671", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T16:13:09.755986Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T16:13:15.339Z"}}], "cna": {"title": "Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission", "credits": [{"lang": "en", "type": "finder", "value": "A. C. Buglione"}, {"lang": "en", "type": "reporter", "value": "drewbug (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "drewbug (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.8, "vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:*"], "vendor": "Mendi", "modules": ["Bluetooth Low Energy Handler"], "product": "Neurofeedback Headset", "versions": [{"status": "affected", "version": "V4"}]}], "timeline": [{"lang": "en", "time": "2026-03-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-07T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-16T23:39:23.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/349702", "name": "VDB-349702 | Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/349702/cti", "name": "VDB-349702 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-2671", "name": "CVE-2026-2671 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/766457", "name": "Submit #766457 | Mendi Innovation AB Mendi V4 Cleartext Transmission of Sensitive Information", "tags": ["third-party-advisory"]}, {"url": "https://doi.org/10.22541/au.177196231.16660369/v1", "tags": ["broken-link"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack's complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "Cleartext Transmission of Sensitive Information"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-310", "description": "Cryptographic Issues"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-16T21:39:22.440Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2671", "state": "PUBLISHED", "dateUpdated": "2026-09-16T21:39:22.440Z", "dateReserved": "2026-02-18T09:19:04.704Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-07T18:02:07.505Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:*"], "modules": ["Bluetooth Low Energy Handler"], "product": "Neurofeedback Headset", "vendor": "Mendi", "versions": [{"status": "affected", "version": "V4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack's complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en el Mendi Neurofeedback Headset V4. Afectada por esta vulnerabilidad est\u00e1 una funcionalidad desconocida del componente Gestor de Bluetooth de Baja Energ\u00eda. Realizar una manipulaci\u00f3n resulta en la transmisi\u00f3n en texto claro de informaci\u00f3n sensible. El ataque solo puede realizarse desde la red local. La complejidad del ataque se califica como alta. La explotaci\u00f3n parece ser dif\u00edcil. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2671", "lastModified": "2026-08-16T06:16:53.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2671", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T16:13:09.755986Z", "version": "2.0.3"}}]}, "published": "2026-03-07T18:16:05.873", "references": [{"source": "cna@vuldb.com", "url": "https://doi.org/10.22541/au.177196231.16660369/v1"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-2671"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/766457"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/349702"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/349702/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}, {"lang": "en", "value": "CWE-319"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "V4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Neurofeedback Headset", "source": "cna", "vendor": "Mendi"}, "product": "neurofeedback_headset", "vendor": "mendi"}], "analysis": {"en": {"generated_at": "2026-04-16T04:32:56.251540+00:00", "value": {"mitigation_remediation": ["Configure the headset to pair only with authorized devices and disable the BLE handler when it is not in use.", "Block or isolate the headset\u2019s network interface using VLANs or firewall rules to prevent access from untrusted networks.", "Set up network monitoring or intrusion detection to alert on cleartext BLE traffic that could contain sensitive information.", "Check the Mendi website or contact support for a firmware update that addresses this issue, and apply it promptly when available."], "summary": {"action": "Assess Impact", "impact": "Local network data exposure"}, "threat_synthesis": {"affected_systems": "The affected product is the Mendi Neurofeedback Headset Version\u202f4. No other versions or products are listed as impacted. The vulnerability is tied to an unidentified functionality within the BLE component of this device.", "description_and_impact": "A flaw in the Bluetooth Low Energy Handler of the Mendi Neurofeedback Headset V4 allows sensitive information to be transmitted in cleartext when a specific manipulation is performed. The vulnerability is categorized as high-complexity and difficult to exploit, but it remains a confidentiality risk because an attacker with local network access could intercept the data. It is associated with CWE\u2011310 (Cleartext Storage or Transmission) and CWE\u2011319 (Cleartext Transmission of Sensitive Information).", "risk_and_exploitability": "The CVSS score of 2.3 indicates a low severity overall, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The device is not present in the CISA KEV catalog. Because the attack can only be performed from the local network, the risk is confined to environments where the headset is connected to a shared or untrusted LAN. Without an official patch, the primary threat is the potential for passive eavesdropping of sensitive data transmitted by the headset."}}}}, "created": "2026-03-09T10:03:58.817732+00:00", "updated": "2026-04-16T04:45:16.123696+00:00", "vendors": ["mendi", "mendi$PRODUCT$neurofeedback_headset"]}