CVE-2025-14346 WHILL Inc. CVE debrief

Who should care

WHILL owners and operators, caregivers, clinics, assisted living and rehabilitation facilities, biomedical/clinical engineering teams, and IT/security staff responsible for mobility-device fleets.

Technical summary

The advisory states that the affected WHILL devices do not enforce authentication for Bluetooth connections. As published by CISA, an attacker within range can pair with the device and then issue movement commands, override speed restrictions, and manipulate configuration profiles without needing credentials or user interaction. WHILL’s listed mitigations are HMI v2.24 for Model C2 and HMI v2.25 for Model F, each described as disabling the BLE interface after installation. The advisory was initially published on 2025-12-30 and Update A on 2026-03-24 revised the mitigation section.

Defensive priority

Urgent. This issue can directly affect movement control on a safety-critical device, so affected deployments should be checked and remediated quickly.

Recommended defensive actions

• Inventory any WHILL Model C2 Electric Wheelchairs and Model F Power Chairs in scope.
• Apply WHILL HMI v2.24 to Model C2 devices and HMI v2.25 to Model F devices.
• Verify that the BLE interface is disabled after installation, as described by WHILL.
• Coordinate with WHILL support if you cannot confirm firmware status or need deployment guidance.
• Use CISA ICS recommended practices to support access control, device inventory, and monitoring around affected equipment.

Evidence notes

Primary evidence comes from the CISA CSAF advisory (ICSMA-25-364-01) published 2025-12-30 and updated 2026-03-24. The advisory description states that the devices do not enforce Bluetooth authentication and that a nearby attacker can pair and issue movement commands, override speed restrictions, and manipulate configuration profiles. The remediation section lists WHILL firmware HMI v2.24 for Model C2 and HMI v2.25 for Model F, both noted as disabling the BLE interface after installation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.