Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission
Summary
| CVE | CVE-2026-2671 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-03-07 18:16:05 UTC |
| Updated | 2026-08-16 06:16:53 UTC |
| Description | A vulnerability was detected in Mendi Neurofeedback Headset V4. Affected by this vulnerability is an unknown functionality of the component Bluetooth Low Energy Handler. Performing a manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network. The attack's complexity is rated as high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. |
Risk And Classification
Primary CVSS: v4.0 2.3 LOW from [email protected]
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.000070000 probability, percentile 0.006210000 (date 2026-04-22)
Problem Types: CWE-310 | CWE-319 | CWE-319 Cleartext Transmission of Sensitive Information | CWE-310 Cryptographic Issues
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 2.3 | LOW | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 2.3 | LOW | CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X |
| 3.1 | [email protected] | Secondary | 3.1 | LOW | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | CNA | DECLARED | 3.1 | LOW | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R |
| 3.0 | CNA | DECLARED | 3.1 | LOW | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R |
| 2.0 | [email protected] | Secondary | 1.8 | AV:A/AC:H/Au:N/C:P/I:N/A:N | |
| 2.0 | CNA | DECLARED | 1.8 | AV:A/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR |
CVSS v4.0 Breakdown
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v3.0 Breakdown
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Mendi | Neurofeedback Headset | affected V4 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/vuln/349702 | [email protected] | vuldb.com | |
| vuldb.com/submit/766457 | [email protected] | vuldb.com | |
| doi.org/10.22541/au.177196231.16660369/v1 | [email protected] | doi.org | |
| vuldb.com/cve/CVE-2026-2671 | [email protected] | vuldb.com | |
| vuldb.com/vuln/349702/cti | [email protected] | vuldb.com | |
| ab3j.radio/mendi.pdf | MITRE | ab3j.radio | |
| vuldb.com | MITRE | vuldb.com | |
| vuldb.com | MITRE | vuldb.com | |
| vuldb.com | MITRE | vuldb.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: drewbug (VulDB User) (en)
CNA: drewbug (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-03-07T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-03-07T01:00:00.000Z | VulDB entry created |
| CNA | 2026-08-16T07:40:06.000Z | VulDB entry last update |