Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking

Security researchers have demonstrated a critical vulnerability in WHILL electric wheelchairs that allows for unauthorized remote control, highlighting safety risks for connected mobility devices, according to CISA’s advisory. The flaw affects WHILL Model C2 and Model F wheelchairs and is tracked as CVE-2025-14346 with a critical severity rating, arising from a missing authentication for Bluetooth connections.

An attacker in Bluetooth range could pair with the device and then control movements, override speed restrictions, and modify configuration profiles without credentials or user interaction. The vulnerability was uncovered by QED Secure Solutions during an annual hackathon organized by WHILL in 2025, and demonstrations showed the wheelchair being steered with a keyboard and game controller, with safety features disabled to exceed intended parameters.

The researchers noted that, while the exploit requires initial proximity, it could theoretically be sustained even after moving out of range, although this was not demonstrated. A patch and mitigations were released in late December 2025, but it remains unclear whether devices receive automatic updates, and WHILL has not commented on the findings.