WiseConnect SDK CVE-2026-19293

Exploitation requires the attacker to be within Bluetooth radio range (typically 10-100 meters depending on transmit power and environment) of a device running the affected WiseConnect BLE stack. A BLE pairing event must occur while the attacker is present and capturing - this can arise from power cycles, unpairing/repairing by the user, or an attacker-induced deauthentication forcing re-pairing. No authentication credentials are required by the attacker; the vulnerability is in the unauthenticated SMP negotiation phase. Limiting factors include: (1) physical proximity - the attacker cannot operate remotely; (2) timing - a live pairing exchange must be captured; (3) offline computation - brute-force of even a reduced BLE key requires non-trivial compute, with effort scaling with actual negotiated key length; (4) no special software configuration on the target device is required - the flaw is present in the default SMP peripheral role behavior of WiseConnect.

The NVD-assigned CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the adjacent network vector (Bluetooth range) and full CIA impact if encryption is defeated. However, AC:L deserves scrutiny: exploitation is not instantaneous - an attacker must first capture a BLE pairing exchange, then invest computational resources to brute-force the shortened key offline. This two-phase requirement arguably warrants AC:H in practice, which would lower the effective risk tier. EPSS data is not present in the input; without it, probability of widespread automated exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, and while the BLERP academic paper provides a detailed theoretical and experimental framework, no weaponized exploit tool is confirmed. The primary real-world risk is targeted eavesdropping on BLE-connected IoT devices in range - scenarios such as medical wearables, industrial sensors, or smart-home peripherals using the WiseConnect BLE stack. The Availability:H rating in the NVD vector is not well-supported by the description alone, which focuses on key recovery rather than denial of service; this metric should be verified with Silicon Labs.

An attacker positioned within Bluetooth radio range of a WiseConnect-based peripheral waits for, or triggers, a BLE re-pairing event between the peripheral and a central device. The attacker captures the SMP pairing exchange - including the Pairing Confirm and Pairing Random PDUs - using a BLE sniffer. Because the peripheral's security request omits its maximum key size, the negotiated AES-CCM key is shorter than the device supports, reducing the brute-force search space; the attacker then recovers the key offline and decrypts all subsequent BLE traffic for that session.