Silicon Labs WiseConnect is susceptible to an authentication bypass via device spoofing, potentially allowing an attacker to intercept or hijack Bluetooth connections.

This is an authentication bypass vulnerability (CWE-290) occurring in the device pairing mechanism. An unauthenticated attacker within physical proximity can spoof a previously bonded device to force the target hardware into a re-pairing state with a malicious device.

The successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of wireless communications. Because this allows for unauthorized pairing, an attacker could potentially gain control over the device or intercept sensitive data, leading to a complete compromise of the affected hardware. With a CVSS score of 8.8, this flaw represents a high risk that requires immediate prioritization.

Immediate Action: Update the WiseConnect firmware to version 4.1.0 or 2.14.0, or the latest available version provided by Silicon Labs, to implement the necessary security patches.

Proactive Monitoring: Monitor Bluetooth pairing logs and device connection events for unauthorized pairing attempts or unexpected re-pairing requests.

Compensating Controls: Ensure devices are deployed in environments with restricted physical access to mitigate the risk of proximity-based Bluetooth attacks.

Public Exploit Available: No

The high severity of this vulnerability necessitates an urgent response. Organizations utilizing the RS9116W or SiWx917 modules must verify their current firmware versions and apply the recommended updates to prevent potential unauthorized access and device hijacking.