editorially independent. We may make money when you click on links
to our partners.
Learn More
A newly disclosed critical vulnerability in WHILL electric wheelchairs could allow an attacker within Bluetooth range to remotely take control of a device.
The flaw affects multiple wheelchair models used by healthcare providers and individual consumers, potentially exposing users to physical harm if exploited.
Exploitation of the vulnerability “… could allow an attacker within Bluetooth range to take control over the product,” said CISA in its advisory.
Inside CVE-2025-14346
At its core, CVE-2025-14346 stems from missing authentication and authorization controls in the Bluetooth pairing process used by affected WHILL wheelchairs.
The devices accept Bluetooth connection requests without adequately verifying whether the connecting device is authorized, allowing an attacker within wireless range — approximately 30 feet — to pair with the wheelchair without the user’s knowledge or consent.
Once paired, the attacker can interact with the same control interfaces used by legitimate mobile applications or smart keys, effectively bypassing built-in safeguards.
The lack of authentication transforms a short-range wireless feature into a viable attack vector, especially in public spaces such as hospitals, clinics, airports, or assisted living facilities where multiple Bluetooth devices may be present.
The vulnerability carries a critical CVSS score of 9.8 due to its low attack complexity, lack of authentication, and potential for physical harm, and while no active exploitation has been confirmed, its simplicity increases the risk of abuse.
Reducing Risk in Connected Assistive Devices
The discovery of the critical Bluetooth vulnerability in WHILL electric wheelchairs highlights the need for a layered approach to securing connected medical and assistive devices.
Because these systems directly affect user safety, mitigation efforts must extend beyond a single patch or control.
- Ensure devices are running the latest firmware and security updates, including protections that prevent unauthorized configuration changes and unsafe commands during motion.
- Require authenticated and user-approved Bluetooth pairing, limiting connections to trusted devices and disabling pairing when not actively needed.
- Implement device-side safety controls that restrict speed changes, movement commands, and configuration updates without direct user input.
- Strengthen application and wireless security by hardening mobile apps, obfuscating configuration data, and monitoring for unauthorized Bluetooth activity.
- Improve operational oversight by inventorying affected devices, tracking firmware versions, and enforcing update and patch compliance across deployments.
- Increase user and provider awareness through clear guidance on secure Bluetooth usage, pairing behavior, and reporting suspicious device behavior.
Together, these measures help reduce the risk of unauthorized control while reinforcing safety and trust in connected medical and assistive devices.
Connectivity Raises Medical Device Risk
This incident reflects a broader and increasingly important trend in healthcare technology: as medical and assistive devices become more connected, they inherit many of the same security weaknesses long observed in traditional IT systems.
Features such as Bluetooth connectivity, cloud-enabled mobile applications, and remote configuration expand the attack surface, often without equivalent investments in strong authentication, access controls, and misuse prevention.
As a result, cybersecurity and patient safety are no longer separate concerns but deeply intertwined.
As connectivity blurs the line between IT security and patient safety, many organizations are turning to zero-trust models to eliminate implicit trust and protect connected systems.
