This vulnerability affects the Bluetooth Low Energy Handler component of the Mendi Neurofeedback Headset version 4. It allows an attacker with local network access to manipulate the device to transmit sensitive information in cleartext. The attack complexity is high, and there is no indication of privilege or user interaction requirements. The vendor has not provided any response or patch information.

Sensitive information transmitted by the device can be intercepted by an attacker on the local network due to lack of encryption. However, the attack complexity is high and exploitation is difficult, limiting the practical impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should limit local network exposure of the device and monitor for updates from the vendor.