Vulnerability · Published Jan 5, 2026 · Assigned by icscert
CVE-2025-14346
Critical 9.8
In plain English
A critical-severity missing authentication in Model C2 Electric Wheelchair from WHILL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)5.6%top 7.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WHILL | Model C2 Electric Wheelchair | all |
| WHILL | Model F Power Chair | all |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-364-01 government-resource