---
title: "Critical Bluetooth Flaw Lets Hackers Hijack WHILL Electric Wheelchairs"
short_title: "Bluetooth flaw hijacks WHILL wheelchairs"
description: "A critical vulnerability (CVE-2025-14346) in WHILL Model C2 and F power chairs allows attackers to take control via Bluetooth. Learn mitigation steps now."
author: "Vitus"
date: 2025-01-24
categories: [Cybersecurity, Vulnerabilities]
tags: [bluetooth, cve-2025-14346, healthcare, iot, critical]
score: 0.95
cve_ids: [CVE-2025-14346]
---
TL;DR
A critical vulnerability (CVE-2025-14346) in WHILL Model C2 Electric Wheelchairs and Model F Power Chairs allows attackers within Bluetooth range to take full control of the devices. Exploitation could lead to unauthorized movement commands, speed overrides, and configuration manipulation—posing severe risks to user safety. WHILL has released firmware updates to mitigate the flaw.
---
Main Content
Critical Bluetooth Vulnerability Exposes WHILL Wheelchairs to Hijacking
In a alarming discovery, cybersecurity researchers have uncovered a critical flaw in WHILL’s Model C2 Electric Wheelchairs and Model F Power Chairs that could allow attackers to seize control of the devices via Bluetooth. The vulnerability, tracked as CVE-2025-14346, stems from a missing authentication mechanism for Bluetooth connections, enabling unauthorized access without user interaction.
This flaw poses a direct threat to user safety, as attackers can issue movement commands, override speed restrictions, and manipulate configuration profiles—all from a distance. With a CVSS score of 9.8 (Critical), the vulnerability demands immediate attention from healthcare providers, users, and cybersecurity professionals.
---
Key Points
- Vulnerability: CVE-2025-14346 (Missing Authentication for Critical Function).
- Affected Devices: WHILL Model C2 Electric Wheelchairs and Model F Power Chairs.
- Attack Vector: Exploitation via Bluetooth range; no credentials or user interaction required.
- Impact: Unauthorized control, speed overrides, and configuration manipulation.
- Severity: CVSS 9.8 (Critical)—high risk to user safety and privacy.
- Mitigation: WHILL has released firmware updates to restrict unauthorized access.
---
Technical Details
#### Vulnerability Overview
The flaw (CVE-2025-14346) is classified under CWE-306: Missing Authentication for Critical Function. It allows attackers within Bluetooth range to:
- Pair with the device without authentication.
- Issue movement commands, including starting, stopping, or changing direction.
- Override speed restrictions, potentially endangering the user.
- Modify configuration profiles, altering device behavior.
The vulnerability affects all versions of WHILL Model C2 and Model F devices, deployed worldwide in healthcare and public health sectors.
#### CVSS Metrics
| Metric | Value |
|----------------------|-----------------------------------------------------------------------|
| CVSS Version | 3.1 |
| Base Score | 9.8 (Critical) |
| Vector String | [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Impact | High (Confidentiality, Integrity, Availability) |
---
Impact Assessment
#### User Safety Risks
The vulnerability exposes users to physical harm, as attackers can:
- Force sudden movements, leading to collisions or falls.
- Disable safety features, such as speed limits or emergency stops.
- Manipulate device settings, causing erratic behavior.
#### Privacy and Security Concerns
Beyond physical risks, the flaw could enable:
- Unauthorized access to user data stored on the device.
- Lateral movement into connected healthcare networks if the wheelchair is linked to other systems.
#### Healthcare Sector Threat
Given the global deployment of WHILL devices in healthcare settings, the vulnerability could disrupt critical medical services and compromise patient safety. Healthcare providers must prioritize patching to prevent exploitation.
---
Mitigation Steps
WHILL has deployed firmware updates to address the vulnerability. Key mitigations include:
#### Device-Side Protections
1. Speed Profile Protection:
- Firmware now prevents unauthorized modification of speed profiles from the mobile app.
2. Unlock Command Restriction:
- Blocks unlock commands from the mobile app or smart key while the wheelchair is in motion.
3. Configuration File Obfuscation:
- Converts JSON configuration files into binary format on Android and iOS to prevent tampering.
#### User and Organizational Actions
- Apply firmware updates immediately via WHILL’s official channels.
- Minimize Bluetooth exposure by disabling it when not in use.
- Isolate devices from business networks and restrict internet access.
- Use secure remote access methods, such as VPNs, if remote management is required.
- Monitor for suspicious activity and report incidents to CISA or WHILL.
For detailed guidance, contact WHILL Inc. or refer to CISA’s [ICS Medical Advisory](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-364-01).
---
Attack Vector
The vulnerability is exploitable by attackers within Bluetooth range (typically up to 10 meters). No prior access or user interaction is required, making it a high-risk threat for public spaces, hospitals, and care facilities.
---
Affected Systems
| Vendor | Device | Status |
|--------------|-------------------------------------------------|------------------|
| WHILL Inc. | Model C2 Electric Wheelchair (all versions) | Known Affected |
| WHILL Inc. | Model F Power Chair (all versions) | Known Affected |
---
Conclusion
The CVE-2025-14346 vulnerability in WHILL’s electric wheelchairs underscores the growing risks of IoT devices in healthcare. With a CVSS score of 9.8, the flaw demands immediate action from users, healthcare providers, and cybersecurity teams. WHILL’s firmware updates provide critical protections, but proactive measures—such as disabling Bluetooth when unused and isolating devices—are essential to mitigate risks.
As cyber threats to medical devices escalate, organizations must adopt defense-in-depth strategies to safeguard patient safety and data integrity. Stay vigilant, apply patches promptly, and report suspicious activity to authorities.
---
References
[^1]: CISA. "[ICS Medical Advisory (ICSMA-25-364-01)](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-364-01)". Retrieved 2025-01-24.
[^2]: MITRE. "[CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)". Retrieved 2025-01-24.
[^3]: WHILL Inc. "[Security Updates for Model C2 and F Power Chairs](https://www.whill.jp/en/)". Retrieved 2025-01-24.
[^4]: CVE. "[CVE-2025-14346 Detail](https://www.cve.org/CVERecord?id=CVE-2025-14346)". Retrieved 2025-01-24.