LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A 9.8 in a power wheelchair: BLE takeover with no authentication

MedDevice Cyber Staff · Dec 30 · 3 min read · Via CISA

WHILL Model C2 and Model F powered wheelchairs shipped a Bluetooth Low Energy interface with missing authentication for a critical function. ICSMA-25-364-01, CVE-2025-14346, base score 9.8. An attacker within Bluetooth range, roughly thirty feet, takes control with no user interaction. Sudden stop. Redirected movement. For the person in the chair that is a physical-safety event, not a data breach.

The QED Secure Solutions team reported it, the crew that has spent years proving these attacks on medical hardware. WHILL later shipped firmware HMI v3.00 and v3.01 with a secure BLE design the FDA authorized, and CISA reissued the advisory in July to say the fix is out.

Wireless convenience on a mobility device is a safety function wearing a consumer-electronics costume. Pair it, sign it, authenticate it. The radius of harm is measured in feet and in people.

Remediation Desk

WHILL Model C2 and Model F chairs accepted Bluetooth control commands without authentication, CVSS 9.8 in ICSMA-25-364-01, so an attacker in range could stop or steer the chair. Apply the remediated firmware and, until then, be aware that BLE control is open in public spaces.

Apply the remediated firmware. Install the WHILL firmware that adds authentication to BLE control, per ICSMA-25-364-01.
Authenticate safety-critical commands. Motion control must require a paired, authenticated session; no movement command should execute from an unauthenticated peer.
Fail safe on unexpected input. Design the controller to ignore or safely reject commands that do not come from an authenticated controller.

Sources

CISA ↗

Questions & Answers

Which WHILL products are affected by CVE-2025-14346?

The WHILL Model C2 and Model F powered wheelchairs. They accepted Bluetooth Low Energy control commands without authentication, so a nearby attacker could take over movement.

How serious is it, and what is the attack range?

It is rated CVSS 9.8. The limiting factor is that it needs Bluetooth range, so an attacker has to be physically near the chair rather than anywhere on the internet.

Is there a fix?

WHILL's remediation and interim mitigations are in ICSMA-25-364-01. Until a fix is applied, the practical protection is to limit pairing and keep the chair's Bluetooth off when it is not in use.

← Back to Vulnerabilities