Silicon Labs WiseConnect CVE-2026-19291

The target device must be a Silicon Labs RS9116W or SiWx91x running WiseConnect firmware prior to the fixed versions (2.14.0 or 4.1.0). An existing BLE bond or pairing relationship must exist between the target device and a legitimate peer - the vulnerability is specifically triggered during re-pairing with a known bonded device, not initial pairing. The attacker must be within Bluetooth radio range (adjacent network vector, AV:A). The CVSS vector PR:N indicates no attacker-side authentication is required. Exploitation is limited by physical proximity to the target device; internet-remote exploitation is not possible. No specific non-default configuration is required beyond the device having an established BLE bond.

The NVD CVSS 3.1 score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a severe but proximity-constrained threat: the attacker must be within Bluetooth radio range (typically 10-100 meters depending on device class), which meaningfully limits the attack surface compared to internet-reachable vulnerabilities. No EPSS score was provided in the input data, so probability cannot be quantified numerically. KEV status is not confirmed, meaning mass active exploitation is not currently evidenced. However, the NDSS-published BLERP paper represents credible, peer-reviewed proof-of-concept research, which substantially lowers the bar for adversary replication. The combination of PR:N (no attacker authentication), AC:L (no complex precondition beyond radio proximity), and full C/H/I:H/A:H impact makes this a genuine operational priority for deployments of WiseConnect-based devices in sensitive or physically accessible environments. The primary limiting factor is the adjacency requirement - this is not remotely exploitable over the internet.

An attacker within Bluetooth range of a WiseConnect-based device that has an existing bond with a legitimate peer initiates a re-pairing exchange, negotiating a weaker security mode (e.g., unauthenticated Just Works instead of the original MITM-protected mode) that the vulnerable stack accepts without enforcement. The NDSS BLERP paper documents this as a reproducible V3 attack variant, indicating a working research prototype exists. With the downgraded security association in place, the attacker can intercept or inject BLE traffic, impersonate the bonded peer, or disrupt device operation.