CVE-2025-14346

Critical

Published: 05 January 2026

Published

05 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0015 34.5th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14346 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cisa (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-18 (Wireless Access) and IA-3 (Device Identification and Authentication).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-18 Wireless Access good match

prevent

AC-18 mandates authentication and encryption for wireless access, directly preventing unauthorized Bluetooth pairing and command issuance in this CVE.

IA-3 Device Identification and Authentication good match

prevent

IA-3 requires identification and authentication of connecting devices, blocking unauthenticated Bluetooth pairing exploited by nearby attackers.

SC-40 Wireless Link Protection partial match

prevent

SC-40 enforces cryptographic mechanisms to protect wireless links, providing secondary mitigation against unauthorized access and manipulation over Bluetooth.

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.

Confidence: LOW · MITRE ATT&CK Enterprise v19.0

NVD Description

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials…

or user interaction.

Deeper analysisAI

CVE-2025-14346 is a missing authentication vulnerability (CWE-306) in the Bluetooth connections of WHILL Model C2 Electric Wheelchairs and Model F Power Chairs. These medical devices fail to enforce authentication, enabling unauthorized access over Bluetooth without requiring credentials.

An attacker within Bluetooth range can exploit this vulnerability with low complexity and no privileges or user interaction needed. Successful exploitation allows pairing with the device to issue movement commands, override speed restrictions, and manipulate configuration profiles, potentially leading to high confidentiality, integrity, and availability impacts as indicated by the CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

The CISA ICS Medical Advisory ICSMA-25-364-01 provides details on mitigation strategies and is available at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-364-01.