A vulnerability in OmniPEMF NeoRhythm’s Bluetooth Low Energy interface allows an attacker on the same local network to manipulate an unknown function, causing authentication to be omitted. The flaw is classified as high complexity and difficult to exploit, which limits its practical threat but still permits unauthorized access to the device’s BLE interface. The CVSS score of 2.3 reflects a low severity impact, meaning the risk to confidentiality, integrity, or availability is modest when the device is isolated from broader networks.

The device affected is the OmniPEMF NeoRhythm, firmware versions up to 20260308. No additional software or OS versions are mentioned. The issue is exclusive to the specific BLE component within the device rather than the broader product line.

Because the attack is constrained to local network traffic, the overall threat surface is narrow. The combination of a high complexity, low CVSS score, and absence from the KEV catalog indicates that widespread exploitation is unlikely. Nonetheless, an attacker who has physical proximity or network access could exploit the missing authentication to gain control over the BLE interface if the device is not patched or otherwise secured.