Bluetooth Authentication Failures Enable Unauthorized Control of Personal Mobility Devices

Security researchers reported serious Bluetooth security weaknesses in personal mobility devices that allow unauthorized control at close range. An Estonian researcher reverse-engineered Äike’s app-controlled e-scooters after the company’s bankruptcy and alleged the scooters shipped with a single default/private “master” key rather than unique per-device secrets, enabling anyone who derives the key to generate valid challenge-response authentication and unlock/control any scooter model the company sold.

Separately, researchers demonstrated remote control of WHILL wheelchairs over Bluetooth, prompting a CISA advisory stating the devices did not enforce authentication for Bluetooth connections. An attacker within Bluetooth range could pair without credentials or user interaction and then control movement, override speed restrictions, and alter configuration profiles—highlighting a broader risk pattern where weak or missing Bluetooth authentication in mobility/IoT products can translate directly into physical safety impacts.