VulnerabilityDeferred

CVE-2025-14346

An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.

CRITICAL 9.3EPSS 5.64%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 5.64% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-306
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-364-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.