CVE-2025-14346 is a critical vulnerability affecting WHILL Model C2 Electric Wheelchairs and Model F Power Chairs, where Bluetooth connections lack authentication. An attacker within Bluetooth range can pair with the device without credentials or user interaction, allowing full control over movement commands, speed settings, and configuration profiles. This vulnerability poses severe risks to user safety and privacy. The CVSS score is 9.8, reflecting high impact on confidentiality, integrity, and availability. No patches are currently available, and no exploits have been observed in the wild yet. European organizations involved in healthcare, rehabilitation centers, and mobility services using these devices are at risk. Mitigation requires disabling Bluetooth when not in use, physical security controls, and close coordination with the vendor for firmware updates. Countries with higher adoption of assistive mobility devices and strong healthcare infrastructure, such as Germany, France, the UK, and the Netherlands, are likely most affected. Immediate attention is critical to prevent potential harm to vulnerable users.
