Skip to main content

SiWx917 WiseConnect CVE-2026-65936

| EUVDEUVD-2026-58085 MEDIUM
Buffer Over-read (CWE-126)
2026-08-13 Silabs GHSA-v4q3-f9mp-442j
Buffer Overflow Wiseconnect
5.3
CVSS 4.0 · Vendor: Silabs
Share

Severity by source

Vendor (Silabs) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Adjacent vector for Bluetooth-range attack, no privileges or interaction needed, low confidentiality impact from memory leak, no integrity or availability impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 13, 2026 - 16:03 vuln.today

DescriptionCVE.org

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

AnalysisAI

Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sensitive data to adjacent Bluetooth attackers. A specially crafted malformed Bluetooth connection request triggers a buffer over-read (CWE-126), causing the device to leak memory contents to the attacker without any authentication requirement. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Enter Bluetooth radio range
Delivery
Craft malformed connection request
Exploit
Transmit to target device
Execution
Trigger buffer over-read in WiseConnect handler
Impact
Receive leaked memory contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be within Bluetooth radio range of the target device (typically 10-100 meters, shorter for Class 3 radios). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 5.3 with AV:A accurately reflects the physical proximity constraint inherent to Bluetooth-range attacks, limiting exposure to devices within approximately 10-100 meters. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth range of a deployed RS9116W or SiWx917 device transmits a specially crafted, malformed Bluetooth connection request. The WiseConnect firmware's connection handler reads beyond the bounds of the request buffer, and the over-read data - potentially containing session keys, memory pointers, or other runtime state - is returned to the attacker's Bluetooth interface. …
Remediation Consult the Silicon Labs advisory at https://community.silabs.com/068Vm00000x0Yqy for the recommended WiseConnect SDK patch version - the input data does not confirm an exact fix version number, so citing one would be speculative. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wiseconnect

View all
CVE-2026-19293 HIGH
8.8 Aug 13

BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force sessi
CVE-2026-19292 HIGH
8.8 Aug 13

Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (L
CVE-2026-19291 HIGH
8.8 Aug 13

Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to

CVE-2026-16101 HIGH
8.8 Aug 13

BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to sp
CVE-2026-65935 HIGH
7.6 Aug 13

Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be

Same weakness CWE-126 – Buffer Over-read

View all
CVE-2017-7668 HIGH
7.5
CVE-2017-7679 CRITICAL POC
9.8
CVE-2021-34584 CRITICAL POC
9.1
CVE-2022-1987 HIGH POC
8.1
CVE-2022-1908 HIGH POC
8.1
CVE-2022-1907 HIGH POC
8.1
CVE-2023-0817 HIGH POC
7.8
CVE-2022-3178 HIGH POC
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Share

CVE-2026-65936 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy