SiWx917 WiseConnect CVE-2026-65936

Exploitation requires the attacker to be within Bluetooth radio range of the target device (typically 10-100 meters, shorter for Class 3 radios). The device must be running the vulnerable WiseConnect SDK and have Bluetooth connection acceptance active - i.e., the Bluetooth interface must be discoverable or otherwise accepting inbound connection requests. No authentication is required by the attacker, and no user interaction is needed on the target. The primary limiting factor is physical proximity: remote internet-based exploitation is not possible. Non-default Bluetooth configurations that reject all unpaired connection requests would limit but not necessarily eliminate exposure, depending on implementation.

The CVSS 4.0 base score of 5.3 with AV:A accurately reflects the physical proximity constraint inherent to Bluetooth-range attacks, limiting exposure to devices within approximately 10-100 meters. The PR:N and UI:N metrics confirm no authentication or victim interaction is needed once the attacker is in range. One notable discrepancy: the vendor-provided vector assigns VI:L (integrity impact) with VC:N, yet the vulnerability description explicitly describes an information leak - a confidentiality impact - making VC:L the more intuitive mapping; this inconsistency should be verified against the vendor advisory. No EPSS data was provided, and the absence of KEV listing suggests exploitation remains theoretical or highly targeted rather than widespread. The realistic threat actor is someone physically proximate to the device - an IoT attacker in a smart building, factory floor, or warehouse environment - meaning even a mid-sized municipal IT team in swidnica managing a fleet of SiWx917-based sensors should treat this as a moderate but bounded risk, with the physical proximity requirement as the primary limiting factor. No public exploit code has been identified at time of analysis.

An attacker within Bluetooth range of a deployed RS9116W or SiWx917 device transmits a specially crafted, malformed Bluetooth connection request. The WiseConnect firmware's connection handler reads beyond the bounds of the request buffer, and the over-read data - potentially containing session keys, memory pointers, or other runtime state - is returned to the attacker's Bluetooth interface. No prior pairing, authentication, or victim interaction is required.