Wiseconnect
Monthly
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sensitive data to adjacent Bluetooth attackers. A specially crafted malformed Bluetooth connection request triggers a buffer over-read (CWE-126), causing the device to leak memory contents to the attacker without any authentication requirement. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to negotiate a lower security level during the re-pairing process with an already-bonded peer, effectively bypassing the previously established security guarantees. Documented as the 'V3' attack variant in the NDSS-published BLERP (BLE Re-Pairing) research paper, this flaw enables high-impact compromise of confidentiality, integrity, and availability across affected WiseConnect firmware lines. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the NDSS publication constitutes academic proof-of-concept disclosure.
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to spoof a previously bonded device and force the target to re-bond with a rogue device, yielding full BLE session control. Both WiseConnect SDK 2.x (before 2.14.0) and 4.x (before 4.1.0) are confirmed affected per vendor release notes and the academic BLERP (BLE Re-Pairing Attacks and Defenses) paper published at NDSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the NDSS paper provides a detailed methodology that could guide motivated researchers to weaponize the technique.
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sensitive data to adjacent Bluetooth attackers. A specially crafted malformed Bluetooth connection request triggers a buffer over-read (CWE-126), causing the device to leak memory contents to the attacker without any authentication requirement. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to negotiate a lower security level during the re-pairing process with an already-bonded peer, effectively bypassing the previously established security guarantees. Documented as the 'V3' attack variant in the NDSS-published BLERP (BLE Re-Pairing) research paper, this flaw enables high-impact compromise of confidentiality, integrity, and availability across affected WiseConnect firmware lines. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the NDSS publication constitutes academic proof-of-concept disclosure.
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to spoof a previously bonded device and force the target to re-bond with a rogue device, yielding full BLE session control. Both WiseConnect SDK 2.x (before 2.14.0) and 4.x (before 4.1.0) are confirmed affected per vendor release notes and the academic BLERP (BLE Re-Pairing Attacks and Defenses) paper published at NDSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the NDSS paper provides a detailed methodology that could guide motivated researchers to weaponize the technique.