The vulnerability identified as CVE-2026-85104 affects the Sooma 2GEN brain stimulator, part of the Sooma tDCS Home Therapy product line. It is classified under CWE-924, indicating improper enforcement of message integrity during transmission in a communication channel. Specifically, an attacker within Bluetooth range can alter brain stimulation parameters without authentication due to insufficient integrity checks in the Bluetooth communication channel.

An attacker within Bluetooth range can make unauthorized changes to brain stimulation parameters on the affected device. This could lead to unintended or harmful stimulation settings being applied to the user. The CVSS 4.0 base score is 5.3 (medium), reflecting the local attack vector with low complexity and no required privileges or user interaction, but with limited impact on confidentiality and integrity and low impact on availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit Bluetooth exposure and ensure the device is used in secure environments to reduce the risk of unauthorized access.