WiseConnect (SiWx917/RS9116W) CVE-2026-65935

BLE legacy pairing (not BLE Secure Connections) must be enabled and active on the target RS9116W or SiWx917 device, and the Passkey Entry association model must be in use for the targeted pairing session. The attacker must be within Bluetooth radio range (adjacent network - CVSS AV:A). AT:P in the CVSS 4.0 vector confirms specific attack timing requirements: the TK manipulation must occur during the active pairing handshake window. Exploitation is not possible against devices using BLE Secure Connections, Just Works association, or OOB pairing. No authentication or user interaction is required once the attacker is in range and a pairing event is occurring.

The CVSS 4.0 score of 7.6 reflects meaningful but proximity-constrained risk: AV:A (Bluetooth adjacency, typically 10-100 m) limits mass internet-scale exploitation, while PR:N and UI:N mean no credentials or victim interaction are needed once within range. AT:P in the CVSS 4.0 vector confirms that specific attack timing or conditions are required (TK manipulation during the pairing handshake window), introducing some operational complexity. VC:H and VI:H indicate full compromise of data confidentiality and integrity on the affected device. No EPSS score is available in the provided data. The absence of a CISA KEV entry indicates no confirmed active exploitation at time of analysis; however, the academic paper (arxiv 2409.02905) publicly discloses the technique, lowering the bar for capable adversaries. Real-world risk is highest in industrial IoT, medical device, and consumer electronics deployments relying on BLE pairing security with legacy mode enabled.

An attacker carrying a Bluetooth-capable device (laptop or embedded radio) positions themselves within Bluetooth range of a deployed RS9116W or SiWx917 device. The attacker initiates a BLE pairing request using Passkey Entry and, during the Confirm/Random exchange, manipulates the TK value to forge valid confirm values - bypassing the authentication check and completing pairing without knowing the actual passkey. The academic paper at arxiv.org/pdf/2409.02905 (vulnerability B-E3) documents the technical approach, providing sufficient detail for a capable attacker to replicate the technique.