Loading story…
A critical security vulnerability with a CVSS score of 9.8 has been identified in WHILL C2 power wheelchairs, potentially allowing attackers to remotely control the devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that exploitation of this flaw could enable unauthorized manipulation of the wheelchairs, posing significant safety risks to users. The vulnerability highlights the growing concern over the security of connected medical and mobility devices.
CISA's advisory provides technical details and recommended mitigations for the WHILL C2 vulnerability, urging users and administrators to apply necessary updates and security measures. The agency also released an advisory for a separate product, AzeoTech DAQFactory, but the primary focus remains on the severe risk associated with the WHILL C2 flaw. Security experts emphasize the importance of promptly addressing such vulnerabilities in assistive technology to prevent potential exploitation and ensure user safety.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets reported that CVE-2025-14346 carries a CVSS score of 9.8 and could let attackers within Bluetooth range take control of WHILL mobility devices. Reports emphasized the safety risks, lack of known public exploitation, and CISA's recommendation to apply mitigations promptly.
CISA released an Industrial Control Systems advisory on security issues affecting WHILL C2 Wheelchairs, alongside a separate advisory for AzeoTech DAQFactory. The advisory provided technical details and mitigation recommendations for the WHILL flaw.
WHILL released mitigations on December 29, 2025, including firmware updates and enhanced security measures for device and app interactions affecting the vulnerable wheelchair models. Users were directed to contact the company for mitigation guidance.
Security researchers at QED Secure Solutions identified CVE-2025-14346 in WHILL Model C2 Electric Wheelchairs and Model F Power Chairs. The vulnerability stems from missing authentication for Bluetooth connections, allowing nearby attackers to pair without authorization and control movement and settings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehipaajournal.com
Open sourcesecurityonline.info
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported serious Bluetooth security weaknesses in personal mobility devices that allow unauthorized control at close range. An Estonian researcher reverse-engineered Äike’s app-controlled e-scooters after the company’s bankruptcy and alleged the scooters shipped with a single default/private “master” key rather than unique per-device secrets, enabling anyone who derives the key to generate valid challenge-response authentication and unlock/control any scooter model the company sold. Separately, researchers demonstrated remote control of **WHILL** wheelchairs over Bluetooth, prompting a **CISA advisory** stating the devices did not enforce authentication for Bluetooth connections. An attacker within Bluetooth range could pair without credentials or user interaction and then control movement, override speed restrictions, and alter configuration profiles—highlighting a broader risk pattern where weak or missing Bluetooth authentication in mobility/IoT products can translate directly into physical safety impacts.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-11492 with a CVSS score of 9.6, was identified in the ConnectWise Automate Agent, allowing for man-in-the-middle (MitM) attacks due to improper HTTP configuration and lack of enforced encryption in transit. The flaw enables agent communications to be configured over HTTP instead of HTTPS, exposing sensitive agent-server traffic to interception, modification, or replay by an attacker positioned on the network path. Security researchers highlighted that the encryption method used to obfuscate some communications over HTTP was insufficient, prompting ConnectWise to release the Automate 2025.9 patch, which enforces HTTPS for all agent communications. This vulnerability could allow attackers to gain unauthorized access to sensitive information or manipulate agent-server interactions, posing significant risks to managed service providers and their clients. The issue was disclosed publicly in mid-October 2025, with both security advisories and vulnerability databases emphasizing its critical nature. The vulnerability does not allow for remote exploitation without network access, but it significantly increases risk in environments where HTTP is used. ConnectWise responded by updating their software to mandate secure communication channels, thereby mitigating the risk of MitM attacks. The flaw affects all versions of the Automate Agent where HTTP was permitted, though specific affected versions were not detailed in the advisories. Organizations using ConnectWise Automate are urged to apply the latest patches immediately to ensure all agent communications are encrypted. The vulnerability underscores the importance of enforcing secure transport protocols in remote monitoring and management (RMM) tools. Security experts warn that failure to address this issue could result in data breaches, unauthorized command execution, or further compromise of managed endpoints. The incident has prompted broader discussions about the security of RMM platforms and the need for robust verification of agent-server communications. While no active exploitation has been reported at the time of disclosure, the high severity rating reflects the potential impact if left unremediated. ConnectWise has provided guidance for customers to verify their configurations and ensure compliance with the new security requirements. The vulnerability is distinct from, but related to, another flaw (CVE-2025-11493) affecting the self-update verification mechanism, which is mitigated by enforcing HTTPS as addressed in CVE-2025-11492.
Jul 12, 2026
**Siemens Heliox EV chargers** were disclosed to contain an **improper access control** weakness (CWE-923) that could allow an attacker with physical access to the charging interface to reach **unauthorized services via the charging cable**. CISA published an ICS advisory describing the issue and noting Siemens has released updated software versions; the advisory lists affected models including the **Heliox Flex 180 kW EV Charging Station** and **Heliox Mobile DC 40 kW EV Charging Station**, and scores the issue **CVSS v3.1 2.6 (Low)** with a vector indicating a **physical** attack requirement (e.g., `AV:P`). Siemens recommends updating to fixed versions and protecting device/network access per its industrial security operational guidelines. Canada’s Centre for Cyber Security also highlighted Siemens’ March 2026 advisory set, including updates for **Heliox Flex (prior to F4.11.1)** and **Heliox Mobile DC 40 (prior to L4.10.1)**, alongside unrelated Siemens product lines (e.g., Mendix, RUGGEDCOM, SIMATIC). A separate Canadian advisory covering **Schneider Electric** products (EcoStruxure and Modicon lines) is a different vendor’s disclosure and does not pertain to the Siemens Heliox EV charger vulnerability.
Jun 29, 2026