CVE-2025-14346

critical · 9.3

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.

9.3

CVSS

5.6%

EPSS (exploit prob.)

93rd

EPSS percentile

2026-01-05

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-306

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-364-01

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-14346