by Kastro
Paper/Archive/CVE-2025-14346

CVE-2025-14346

WHILL Model C2 Electric Wheelchair — WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections.

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.9.929 × 2018.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.

Affected

ProductAffectedFixed inSource
Model C2 Electric Wheelchairall–CNA
Model F Power Chairall–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-25-364-01