CVE-2026-2756

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2756", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-19T15:01:39.688Z", "datePublished": "2026-03-21T17:32:08.129Z", "dateUpdated": "2026-09-16T21:45:11.604Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-16T21:45:11.604Z"}, "title": "OmniPEMF NeoRhythm BLE missing authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-306", "lang": "en", "description": "Missing Authentication"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "OmniPEMF", "product": "NeoRhythm", "versions": [{"version": "20260308", "status": "affected"}], "cpes": ["cpe:2.3:a:omnipemf:neorhythm:*:*:*:*:*:*:*:*"], "modules": ["BLE Interface"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-21T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-21T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-16T23:45:09.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "A. C. Buglione", "type": "finder"}, {"lang": "en", "value": "drewbug (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "drewbug (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/352383", "name": "VDB-352383 | OmniPEMF NeoRhythm BLE missing authentication", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/352383/cti", "name": "VDB-352383 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-2756", "name": "CVE-2026-2756 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/774937", "name": "Submit #774937 | OmniPEMF NeoRhythm U-BAND Missing Authentication for Critical Function", "tags": ["third-party-advisory"]}, {"url": "https://ab3j.radio/NeoRhythm.pdf", "tags": ["related"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:17:47.139567Z", "id": "CVE-2026-2756", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:40:08.348Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2756", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:17:47.139567Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:17:51.535Z"}}], "cna": {"title": "OmniPEMF NeoRhythm BLE missing authentication", "credits": [{"lang": "en", "type": "finder", "value": "A. C. Buglione"}, {"lang": "en", "type": "reporter", "value": "drewbug (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "drewbug (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:omnipemf:neorhythm:*:*:*:*:*:*:*:*"], "vendor": "OmniPEMF", "modules": ["BLE Interface"], "product": "NeoRhythm", "versions": [{"status": "affected", "version": "20260308"}]}], "timeline": [{"lang": "en", "time": "2026-03-21T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-21T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-16T23:45:09.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/352383", "name": "VDB-352383 | OmniPEMF NeoRhythm BLE missing authentication", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/352383/cti", "name": "VDB-352383 | CTI Indicators (IOB, IOC)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-2756", "name": "CVE-2026-2756 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/774937", "name": "Submit #774937 | OmniPEMF NeoRhythm U-BAND Missing Authentication for Critical Function", "tags": ["third-party-advisory"]}, {"url": "https://ab3j.radio/NeoRhythm.pdf", "tags": ["related"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-16T21:45:11.604Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2756", "state": "PUBLISHED", "dateUpdated": "2026-09-16T21:45:11.604Z", "dateReserved": "2026-02-19T15:01:39.688Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-21T17:32:08.129Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:omnipemf:neorhythm:*:*:*:*:*:*:*:*"], "modules": ["BLE Interface"], "product": "NeoRhythm", "vendor": "OmniPEMF", "versions": [{"status": "affected", "version": "20260308"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en OmniPEMF NeoRhythm hasta el 20260308. Esto afecta una funci\u00f3n desconocida del componente Interfaz BLE. Dicha manipulaci\u00f3n conduce a la falta de autenticaci\u00f3n. El ataque solo puede ser iniciado dentro de la red local. Este ataque se caracteriza por una alta complejidad. La explotabilidad se reporta como dif\u00edcil. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2756", "lastModified": "2026-09-16T22:17:01.787", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.2, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2756", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T16:17:47.139567Z", "version": "2.0.3"}}]}, "published": "2026-03-21T18:16:01.340", "references": [{"source": "cna@vuldb.com", "url": "https://ab3j.radio/NeoRhythm.pdf"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-2756"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/774937"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/352383"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/352383/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260308"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "NeoRhythm", "source": "cna", "vendor": "OmniPEMF"}, "product": "neorhythm", "vendor": "omnipemf"}], "analysis": {"en": {"generated_at": "2026-03-21T18:20:36.870968+00:00", "value": {"mitigation_remediation": ["Ensure the device firmware is updated to a version later than 20260308 once a vendor patch becomes available.", "Restrict BLE communication to trusted devices or sub\u2011nets, and employ strong network segmentation to isolate the NeoRhythm from public or untrusted local networks.", "Monitor local wireless traffic for anomalous BLE connections and log any unauthorized access attempts.", "Consult OmniPEMF support for additional guidance or intermediate mitigations while a patch is released."], "summary": {"action": "Assess", "impact": "Authentication bypass in local BLE interface"}, "threat_synthesis": {"affected_systems": "The device affected is the OmniPEMF NeoRhythm, firmware versions up to 20260308. No additional software or OS versions are mentioned. The issue is exclusive to the specific BLE component within the device rather than the broader product line.", "description_and_impact": "A vulnerability in OmniPEMF NeoRhythm\u2019s Bluetooth Low Energy interface allows an attacker on the same local network to manipulate an unknown function, causing authentication to be omitted. The flaw is classified as high complexity and difficult to exploit, which limits its practical threat but still permits unauthorized access to the device\u2019s BLE interface. The CVSS score of 2.3 reflects a low severity impact, meaning the risk to confidentiality, integrity, or availability is modest when the device is isolated from broader networks.", "risk_and_exploitability": "Because the attack is constrained to local network traffic, the overall threat surface is narrow. The combination of a high complexity, low CVSS score, and absence from the KEV catalog indicates that widespread exploitation is unlikely. Nonetheless, an attacker who has physical proximity or network access could exploit the missing authentication to gain control over the BLE interface if the device is not patched or otherwise secured."}}}}, "created": "2026-03-23T09:48:58.160137+00:00", "updated": "2026-03-25T14:47:00.390512+00:00", "vendors": ["omnipemf", "omnipemf$PRODUCT$neorhythm"]}