WiseConnect SDK CVE-2026-16101

The target device must be running a vulnerable WiseConnect SDK version (2.x before 2.14.0 or 4.x before 4.1.0) on RS9116W or SiWx917 hardware. The device must have previously completed a BLE bonding procedure with at least one legitimate peer, as the attack exploits the re-pairing path rather than initial pairing. The attacker must be within BLE radio range (typically 10-100 meters in open environments, less through walls/shielding) - no internet-routable attack path exists. The attacker must be able to determine the BLE device address of the previously bonded peer, which can be obtained via passive scanning if the peer is advertising or via prior reconnaissance. No authentication, no user interaction on the victim device, and no non-default configuration setting is required beyond the existence of a prior bond. Exploitation is limited by physical proximity and the need to identify the bonded peer address; it is not remotely exploitable over the internet and is not suitable for mass automated scanning.

The CVSS 8.8 High score is partially offset by the AV:A (adjacent network) requirement - exploitation is constrained to BLE radio range, typically 10-100 meters depending on antenna and environment, which eliminates purely remote internet-scale attacks. The AC:L/PR:N/UI:N combination means that within BLE range no additional barriers exist: no credentials, no complex timing, no victim interaction is required. C:H/I:H/A:H indicates full compromise of the BLE session once re-pairing succeeds. EPSS data was not provided, and given the physical-proximity constraint and niche hardware platform, widespread automated exploitation is unlikely. No CISA KEV entry and no public POC reduce urgency beyond lab environments, but the NDSS academic paper provides sufficient detail for a capable researcher to replicate the attack. The primary real-world risk is targeted: an attacker who can place themselves within BLE range of a deployed device using a WiseConnect module - such as in IoT industrial or consumer environments - and knows the bonded peer's device address can silently hijack the BLE link. The CVSS vector's S:U (unchanged scope) means post-exploitation impact is bounded to the BLE channel rather than lateral movement into adjacent systems, which is a meaningful constraint on blast radius.

An attacker positions within BLE radio range of a deployed RS9116W or SiWx917 device that has previously bonded with a legitimate peer (e.g., a mobile app, sensor, or controller). The attacker uses a BLE sniffer to capture or enumerate the bonded peer's device address, then configures a rogue BLE adapter to spoof that address and initiates a re-pairing request. The vulnerable WiseConnect stack accepts the re-pairing without verifying cryptographic proof of the original long-term keys, completing the bond to the rogue device and granting the attacker full read/write access to exposed BLE services. The BLERP paper presented at NDSS provides a documented attack methodology that lowers the bar for replication.