Hijacked Mobility: CISA Warns of Critical 9.8 Flaw Allowing Remote Control of WHILL Power Chairs

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory about a critical safety vulnerability in WHILL Model C2 and Model F power chairs that could let an unauthorised attacker remotely control the device via Bluetooth. The flaw, tracked as CVE-2025-14346, carries a CVSS score of 9.8, signalling high-severity risk to physical safety.

The issue stems from devices that do not enforce authentication for Bluetooth connections, meaning an attacker within signal range can pair with the chair and issue movement commands, override speed restrictions, and manipulate configuration profiles without credentials or user interaction. WHILL Inc. deployed a series of fixes on 29 December 2025, focusing on firmware hardening and application security to prevent remote hijacking.

Key mitigations include speed profile protection, motion lockout to block unlock commands while in motion, and app obfuscation of configuration files to deter reverse engineering. Users and caregivers are urged to contact WHILL Inc. for information on updates and safety, as the advisory warns of the potential for the chair to be steered or accelerated without the user’s input.