Silicon Labs WiseConnect contains a vulnerability that weakens the protection of Long Term Keys during re-pairing, exposing devices to potential brute-force attacks.

This is an authentication bypass vulnerability (CWE-305) involving the insufficient protection of the Long Term Key (LTK). The system allows a lower security level during re-pairing than the previous session, which significantly reduces the difficulty of brute-forcing the key.

Successful exploitation of this vulnerability allows an attacker to recover the LTK, effectively breaking the encryption of the Bluetooth connection. This leads to complete data exposure and potential unauthorized control over the device, justifying the high 8.8 CVSS score. Protecting the LTK is critical for maintaining the confidentiality of sensitive data transmitted over Bluetooth.

Immediate Action: Update WiseConnect firmware to version 4.1.0 or 2.14.0, which enforces stronger security requirements during the re-pairing process to protect the LTK.

Proactive Monitoring: Monitor for increased frequency of authentication failures or unusual connection attempts that might suggest an attempt to brute-force the LTK.

Compensating Controls: Implement physical security measures around devices to limit the proximity required for an attacker to initiate the re-pairing sequence.

Public Exploit Available: No

Immediate firmware updates are required to mitigate the risk of LTK brute-forcing. Security teams should prioritize patching this vulnerability to ensure that encrypted Bluetooth traffic remains protected against sophisticated interception attempts.