CVE-2026-2671 identifies a vulnerability in the Bluetooth Low Energy Handler component of the Mendi Neurofeedback Headset V4. The vulnerability leads to cleartext transmission of sensitive information when manipulated by an attacker on the local network. The attack complexity is high, and no privileges or user interaction are required. The vendor was contacted but did not provide any response or remediation details. No affected versions or patches are specified.

The vulnerability results in the exposure of sensitive information via cleartext transmission over Bluetooth Low Energy. This could allow an attacker within local network range to intercept sensitive data. However, the impact is limited to confidentiality with no integrity or availability effects. The attack requires local network access and is rated as having high complexity, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches are available, users should limit local network exposure of the device and monitor for updates from the vendor.