EUVD-2026-57926
GHSA-8pg2-cp78-vjmv
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A reflects Bluetooth adjacency requirement; PR:N because attacker initiates re-pairing without credentials; AC:L as no complex conditions beyond proximity and an existing bond.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.
AnalysisAI
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to negotiate a lower security level during the re-pairing process with an already-bonded peer, effectively bypassing the previously established security guarantees. Documented as the 'V3' attack variant in the NDSS-published BLERP (BLE Re-Pairing) research paper, this flaw enables high-impact compromise of confidentiality, integrity, and availability across affected WiseConnect firmware lines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target device must be a Silicon Labs RS9116W or SiWx91x running WiseConnect firmware prior to the fixed versions (2.14.0 or 4.1.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 8.8 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a severe but proximity-constrained threat: the attacker must be within Bluetooth radio range (typically 10-100 meters depending on device class), which meaningfully limits the attack surface compared to internet-reachable vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within Bluetooth range of a WiseConnect-based device that has an existing bond with a legitimate peer initiates a re-pairing exchange, negotiating a weaker security mode (e.g., unauthenticated Just Works instead of the original MITM-protected mode) that the vulnerable stack accepts without enforcement. The NDSS BLERP paper documents this as a reproducible V3 attack variant, indicating a working research prototype exists. … |
| Remediation | Upgrade WiseConnect 2.x deployments to version 2.14.0 or later, and WiseConnect 4.x deployments to version 4.1.0 or later, per the vendor advisory at https://community.silabs.com/068Vm00000x0yyH. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Silicon Labs RS9116W and SiWx91x devices in your environment, recording their current firmware versions and WiseConnect product lines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wiseconnect
View allBLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force sessi
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (L
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to sp
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sens
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today