EUVD-2026-57925
GHSA-6jfp-5vf9-mpxj
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A reflects BLE radio-range constraint; PR:N confirmed since spoofing bypasses authentication without credentials; full CIA impact follows from complete BLE session takeover.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
AnalysisAI
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to spoof a previously bonded device and force the target to re-bond with a rogue device, yielding full BLE session control. Both WiseConnect SDK 2.x (before 2.14.0) and 4.x (before 4.1.0) are confirmed affected per vendor release notes and the academic BLERP (BLE Re-Pairing Attacks and Defenses) paper published at NDSS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target device must be running a vulnerable WiseConnect SDK version (2.x before 2.14.0 or 4.x before 4.1.0) on RS9116W or SiWx917 hardware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 High score is partially offset by the AV:A (adjacent network) requirement - exploitation is constrained to BLE radio range, typically 10-100 meters depending on antenna and environment, which eliminates purely remote internet-scale attacks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positions within BLE radio range of a deployed RS9116W or SiWx917 device that has previously bonded with a legitimate peer (e.g., a mobile app, sensor, or controller). The attacker uses a BLE sniffer to capture or enumerate the bonded peer's device address, then configures a rogue BLE adapter to spoof that address and initiates a re-pairing request. … |
| Remediation | Upgrade to WiseConnect SDK 4.1.0 or later for the SiWx917 platform, or to WiseConnect SDK 2.14.0 or later for RS9116W deployments, as documented in vendor release notes at https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes and https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployed products and systems running WiseConnect SDK 2.x or 4.x and audit customer exposure across your IoT and embedded product lines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wiseconnect
View allBLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force sessi
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (L
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sens
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today