Vulnerability · Published Aug 13, 2026 · Assigned by Silabs
CVE-2026-16101forced re-pairing with already bonded device
High 8.8
In plain English
A high-severity authentication bypass by spoofing in WiseConnect from silabs.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 71.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| silabs.com | WiseConnect | 4.0.0 – before 4.1.02.0.0 – before 2.14.0 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes release-notes
- https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes release-notes
- https://community.silabs.com/068Vm00000x0yyH vendor-advisory, permissions-required
- https://www.ndss-symposium.org/ndss-paper/blerp-ble-re-pairing-attacks-and-defenses/ related