Skip to main content

WiseConnect (SiWx917/RS9116W) CVE-2026-65935

| EUVDEUVD-2026-58082 HIGH
Authentication Bypass by Primary Weakness (CWE-305)
2026-08-13 Silabs GHSA-gf4f-g545-p55p
Authentication Bypass Wiseconnect
7.6
CVSS 4.0 · Vendor: Silabs
Share

Severity by source

Vendor (Silabs) PRIMARY
7.6 HIGH
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.8 MEDIUM

Adjacent Bluetooth vector with AC:H reflecting the required in-window TK manipulation (AT:P equivalent); PR:N as no prior authentication is needed; no availability or scope change impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 15:47 vuln.today
CVE Published
Aug 13, 2026 - 14:24 cve.org
HIGH 7.6

DescriptionCVE.org

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.

AnalysisAI

Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position within Bluetooth radio range
Delivery
Initiate BLE legacy Passkey Entry pairing request
Exploit
Intercept pairing handshake and manipulate TK value
Execution
Forge valid Confirm values
Persist
Bypass authentication and complete pairing
Impact
Access protected BLE GATT services on target device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation BLE legacy pairing (not BLE Secure Connections) must be enabled and active on the target RS9116W or SiWx917 device, and the Passkey Entry association model must be in use for the targeted pairing session. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.6 reflects meaningful but proximity-constrained risk: AV:A (Bluetooth adjacency, typically 10-100 m) limits mass internet-scale exploitation, while PR:N and UI:N mean no credentials or victim interaction are needed once within range. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker carrying a Bluetooth-capable device (laptop or embedded radio) positions themselves within Bluetooth range of a deployed RS9116W or SiWx917 device. The attacker initiates a BLE pairing request using Passkey Entry and, during the Confirm/Random exchange, manipulates the TK value to forge valid confirm values - bypassing the authentication check and completing pairing without knowing the actual passkey. …
Remediation Consult the Silicon Labs security advisory at https://community.silabs.com/068Vm00000x0Yqy for patched WiseConnect SDK versions and apply the vendor-supplied update as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all devices using Silicon Labs RS9116W or SiWx917 modules and determine WiseConnect SDK versions deployed. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wiseconnect

View all
CVE-2026-19293 HIGH
8.8 Aug 13

BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force sessi
CVE-2026-19292 HIGH
8.8 Aug 13

Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (L
CVE-2026-19291 HIGH
8.8 Aug 13

Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to

CVE-2026-16101 HIGH
8.8 Aug 13

BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to sp
CVE-2026-65936 MEDIUM
5.3 Aug 13

Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sens

Same weakness CWE-305 – Authentication Bypass by Primary Weakness

View all
CVE-2025-31161 CRITICAL POC
9.8
CVE-2024-50478 CRITICAL
9.8
CVE-2023-34124 CRITICAL POC
9.8
CVE-2023-1307 CRITICAL POC
9.8
CVE-2023-0777 CRITICAL POC
9.8
CVE-2022-2651 CRITICAL POC
9.8
CVE-2026-25555 CRITICAL POC
9.3
CVE-2020-10923 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-65935 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy