A flaw in the Bluetooth Low Energy Handler of the Mendi Neurofeedback Headset V4 allows sensitive information to be transmitted in cleartext when a specific manipulation is performed. The vulnerability is categorized as high-complexity and difficult to exploit, but it remains a confidentiality risk because an attacker with local network access could intercept the data. It is associated with CWE‑310 (Cleartext Storage or Transmission) and CWE‑319 (Cleartext Transmission of Sensitive Information).

The affected product is the Mendi Neurofeedback Headset Version 4. No other versions or products are listed as impacted. The vulnerability is tied to an unidentified functionality within the BLE component of this device.

The CVSS score of 2.3 indicates a low severity overall, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The device is not present in the CISA KEV catalog. Because the attack can only be performed from the local network, the risk is confined to environments where the headset is connected to a shared or untrusted LAN. Without an official patch, the primary threat is the potential for passive eavesdropping of sensitive data transmitted by the headset.