Search
Find a vulnerability
Search criteria
2 vulnerabilities by Mendi
CVE-2026-2671 (GCVE-0-2026-2671)
Vulnerability from nvd – Published: 2026-03-07 18:02 – Updated: 2026-08-16 05:38
VLAI
EPSS
VEX
Title
Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission
Summary
A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack's complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 16:13 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/349702 | vdb-entry |
| https://vuldb.com/vuln/349702/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-2671 | third-party-advisory |
| https://vuldb.com/submit/766457 | third-party-advisory |
| https://doi.org/10.22541/au.177196231.16660369/v1 | broken-link |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mendi | Neurofeedback Headset |
Affected:
V4
cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T16:13:09.755986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T16:28:55.048Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:*"
],
"modules": [
"Bluetooth Low Energy Handler"
],
"product": "Neurofeedback Headset",
"vendor": "Mendi",
"versions": [
{
"status": "affected",
"version": "V4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "drewbug (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "drewbug (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack\u0027s complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.8,
"vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T05:38:18.609Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-349702 | Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/349702"
},
{
"name": "VDB-349702 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/349702/cti"
},
{
"name": "CVE-2026-2671 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-2671"
},
{
"name": "Submit #766457 | Mendi Innovation AB Mendi V4 Cleartext Transmission of Sensitive Information",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/766457"
},
{
"tags": [
"broken-link"
],
"url": "https://doi.org/10.22541/au.177196231.16660369/v1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T07:40:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-2671",
"datePublished": "2026-03-07T18:02:07.505Z",
"dateReserved": "2026-02-18T09:19:04.704Z",
"dateUpdated": "2026-08-16T05:38:18.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2671 (GCVE-0-2026-2671)
Vulnerability from cvelistv5 – Published: 2026-03-07 18:02 – Updated: 2026-08-16 05:38
VLAI
EPSS
VEX
Title
Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission
Summary
A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack's complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-11 16:13 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/349702 | vdb-entry |
| https://vuldb.com/vuln/349702/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-2671 | third-party-advisory |
| https://vuldb.com/submit/766457 | third-party-advisory |
| https://doi.org/10.22541/au.177196231.16660369/v1 | broken-link |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mendi | Neurofeedback Headset |
Affected:
V4
cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2671",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-11T16:13:09.755986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T16:28:55.048Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mendi:neurofeedback_headset:*:*:*:*:*:*:*:*"
],
"modules": [
"Bluetooth Low Energy Handler"
],
"product": "Neurofeedback Headset",
"vendor": "Mendi",
"versions": [
{
"status": "affected",
"version": "V4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "drewbug (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "drewbug (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack\u0027s complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.8,
"vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-310",
"description": "Cryptographic Issues",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-16T05:38:18.609Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-349702 | Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/349702"
},
{
"name": "VDB-349702 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/349702/cti"
},
{
"name": "CVE-2026-2671 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-2671"
},
{
"name": "Submit #766457 | Mendi Innovation AB Mendi V4 Cleartext Transmission of Sensitive Information",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/766457"
},
{
"tags": [
"broken-link"
],
"url": "https://doi.org/10.22541/au.177196231.16660369/v1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-07T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T07:40:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-2671",
"datePublished": "2026-03-07T18:02:07.505Z",
"dateReserved": "2026-02-18T09:19:04.704Z",
"dateUpdated": "2026-08-16T05:38:18.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}