CVE-2025-14346

Published Jan 5, 2026

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-14346 affects WHILL Model C2 Electric Wheelchairs and Model F Power Chairs. These devices lack proper authentication for Bluetooth connections. An attacker within Bluetooth range (approximately 30 feet) can pair with the wheelchair and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction. This vulnerability stems from the absence of authentication for critical functions in the wheelchair's control system. Successful exploitation could allow malicious actors to manipulate wheelchair movements, potentially causing physical harm to users or bystanders. CISA has issued an urgent warning about this flaw.

Description: WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.
Source: ics-cert@hq.dhs.gov
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

ics-cert@hq.dhs.gov: CWE-306

Hype score: Not currently trending

References

Sources include official advisories and independent security research.