A 9.8 in a power wheelchair: BLE takeover with no authentication

MedDevice Cyber Staff · Dec 30 · 3 min read · Via CISA

WHILL Model C2 and Model F powered wheelchairs shipped a Bluetooth Low Energy interface with missing authentication for a critical function. ICSMA-25-364-01, CVE-2025-14346, base score 9.8. An attacker within Bluetooth range, roughly thirty feet, takes control with no user interaction. Sudden stop. Redirected movement. For the person in the chair that is a physical-safety event, not a data breach.

Missing authentication on a wireless control interface is a specific and common oversight. The radio link is built to let a companion app read state and send commands, and in the push to make pairing effortless the command channel is left willing to take orders from anything that speaks the protocol. A device advertising itself for easy connection advertises itself to anyone nearby.

On a powered chair the consequence is kinetic rather than informational. The interface a rider uses to move is the one an attacker in range reaches, and a machine that carries a person can be halted without warning or steered off its intended path. The rider is often someone with limited ability to brace or recover, which turns a brief burst of unauthorized commands into a fall or a collision.

The QED Secure Solutions team reported it, the crew that has spent years proving these attacks on medical hardware. WHILL later shipped firmware HMI v3.00 and v3.01 with a secure BLE design the FDA authorized, and CISA reissued the advisory in July to say the fix is out.

The resolution followed the arc coordinated disclosure is meant to produce. An outside team surfaced the flaw, the maker engineered a secure version of the radio design, a regulator reviewed it, and the advisory was updated to record that a fix existed. That the correction required new firmware and formal review is the part worth holding onto, because building it in securely at the start is cheaper than retrofitting it later.

Wireless convenience on a mobility device is a safety function wearing a consumer-electronics costume. Pair it, sign it, authenticate it. The radius of harm is measured in feet and in people.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

WHILL Model C2 and Model F chairs accepted Bluetooth control commands without authentication, CVSS 9.8 in ICSMA-25-364-01, so an attacker in range could stop or steer the chair. Apply the remediated firmware and, until then, be aware that BLE control is open in public spaces.

Apply the remediated firmware. Install the WHILL firmware that adds authentication to BLE control, per ICSMA-25-364-01.
Authenticate safety-critical commands. Motion control must require a paired, authenticated session; no movement command should execute from an unauthenticated peer.
Fail safe on unexpected input. Design the controller to ignore or safely reject commands that do not come from an authenticated controller.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

net_wireless ctl_therapy

Contributing

use_home sys_firmware_update app_mobile

EMB3D

PID-331 PID-41 PID-4111

Fix the class in your product

The device honors control commands from any peer in radio range. As the maker, gate every state-changing characteristic behind an authenticated, bonded link on the device itself, and strip undocumented command paths from the release image.

Authenticate on the device, not the app. Reject writes to state-changing characteristics unless the link is encrypted, bonded, and authenticated.
Bond with a modern pairing method. Require LE Secure Connections and add a physical confirmation on a safety-critical device.
Fail to a safe state. On an unexpected or unauthenticated command, hold or revert rather than acting.

Mapped EMB3D mitigations

Questions & Answers

Which WHILL products are affected by CVE-2025-14346?

The WHILL Model C2 and Model F powered wheelchairs. They accepted Bluetooth Low Energy control commands without authentication, so a nearby attacker could take over movement.

How serious is it, and what is the attack range?

It is rated CVSS 9.8. The limiting factor is that it needs Bluetooth range, so an attacker has to be physically near the chair rather than anywhere on the internet.

Is there a fix?

WHILL's remediation and interim mitigations are in ICSMA-25-364-01. Until a fix is applied, the practical protection is to limit pairing and keep the chair's Bluetooth off when it is not in use.

← Back to Vulnerabilities