Loading story…
Security researchers reported serious Bluetooth security weaknesses in personal mobility devices that allow unauthorized control at close range. An Estonian researcher reverse-engineered Äike’s app-controlled e-scooters after the company’s bankruptcy and alleged the scooters shipped with a single default/private “master” key rather than unique per-device secrets, enabling anyone who derives the key to generate valid challenge-response authentication and unlock/control any scooter model the company sold.
Separately, researchers demonstrated remote control of WHILL wheelchairs over Bluetooth, prompting a CISA advisory stating the devices did not enforce authentication for Bluetooth connections. An attacker within Bluetooth range could pair without credentials or user interaction and then control movement, override speed restrictions, and alter configuration profiles—highlighting a broader risk pattern where weak or missing Bluetooth authentication in mobility/IoT products can translate directly into physical safety impacts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Moorats reported the e-scooter key-management problem to the hardware supplier, which replied that managing the cryptographic keys was the manufacturer's responsibility. With Äike bankrupt, the report indicated there was no clear remediation path for affected scooter owners.
After Äike's bankruptcy left scooters dependent on failing backend services, researcher Rasmus Moorats reverse-engineered the Android app and Bluetooth traffic and found that scooters appeared to use the same placeholder/default private key rather than unique per-device secrets. He demonstrated that a short proof-of-concept could unlock any Äike scooter within Bluetooth range.
CISA issued an advisory for certain WHILL wheelchairs stating they did not enforce authentication for Bluetooth connections. An attacker within Bluetooth range could pair without credentials or user interaction and then control movement, override speed restrictions, and alter configuration profiles.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability with a CVSS score of 9.8 has been identified in WHILL C2 power wheelchairs, potentially allowing attackers to remotely control the devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory warning that exploitation of this flaw could enable unauthorized manipulation of the wheelchairs, posing significant safety risks to users. The vulnerability highlights the growing concern over the security of connected medical and mobility devices. CISA's advisory provides technical details and recommended mitigations for the WHILL C2 vulnerability, urging users and administrators to apply necessary updates and security measures. The agency also released an advisory for a separate product, AzeoTech DAQFactory, but the primary focus remains on the severe risk associated with the WHILL C2 flaw. Security experts emphasize the importance of promptly addressing such vulnerabilities in assistive technology to prevent potential exploitation and ensure user safety.
Jun 29, 2026
Researchers disclosed three vulnerabilities in Bluetooth audio devices built on Airoha systems-on-chip that can allow an attacker within radio range to gain unauthorized access to device memory and communications. The flaws, tracked as **`CVE-2025-20700`**, **`CVE-2025-20701`**, and **`CVE-2025-20702`**, stem from missing authentication in GATT and Bluetooth BR/EDR components and weak permission controls in a proprietary protocol, affecting headphones and earbuds sold by brands including **Sony, Bose, Jabra, JBL, Marshall, Beyerdynamic, and Teufel**. ERNW researchers said the bugs can be chained to hijack the Bluetooth link between a phone and an audio device, issue commands to the paired phone through the **Hands-Free Profile**, eavesdrop on conversations, and potentially overwrite firmware for remote code execution on the accessory. The attack requires proximity because exploitation is limited by Bluetooth range, but defenders were urged to apply vendor firmware updates and investigate or restart devices showing abnormal Bluetooth behavior.
Jul 24, 2026
Researchers at the University of California San Diego disclosed severe flaws in the dealer-installed aftermarket **KARR Security System**, a Bluetooth-enabled alarm and anti-theft device estimated to be present in more than **2 million U.S. vehicles**. The vulnerabilities allow an attacker within Bluetooth range to silently unlock doors, disable alarms, trigger horns and lights, and even block the engine from starting, creating both theft and roadside immobilization risks. The researchers said the issue stems in part from a shared embedded authentication key used across KARR devices, which they extracted by reverse-engineering the official mobile app and validating with a proof-of-concept Android tool. The findings also raised privacy concerns because KARR devices broadcast identifiable Bluetooth signals that could be correlated with public WiGLE data to estimate deployment and potentially infer vehicle movements or frequently visited locations. **Acrisure Protection Group**, which sells the KARR system, released a firmware update after responsible disclosure, but remediation requires owners or dealerships to identify the hardware and manually apply the patch through the KARR smartphone app. Researchers warned that many drivers may not realize the device is installed, because it is often added by dealerships and can remain in vehicles after resale.
Jul 24, 2026