Silicon Labs WiseConnect is affected by a security regression in the Bluetooth re-pairing process that permits the use of insufficient security levels.

This is an authentication bypass vulnerability (CWE-290) where the system fails to enforce adequate security during the re-pairing process. An unauthenticated attacker can leverage this downgrade in security requirements to compromise the pairing session.

By forcing a lower security level during re-pairing, an attacker may be able to bypass existing authentication protections. This could lead to unauthorized access to the device or the interception of data, creating significant operational and security risks. Given the 8.8 CVSS score, organizations must treat this as a high-priority update to maintain the integrity of their wireless infrastructure.

Immediate Action: Apply the vendor-provided firmware updates to version 4.1.0 or 2.14.0, which remediate the insufficient security level enforcement in the pairing process.

Proactive Monitoring: Review device logs for anomalous pairing behaviors and ensure that all Bluetooth connections are audited for unexpected security parameter changes.

Compensating Controls: Where possible, restrict the physical environment around the devices to reduce the feasibility of proximity-based attacks.

Public Exploit Available: No

Organizations should proceed with firmware updates immediately to resolve this security flaw. Failure to patch the affected WiseConnect devices leaves the wireless communication channel vulnerable to interception and unauthorized access.