CVE-2026-65935
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.
Risk Assessment
An attacker can bypass the pairing process and gain unauthorized access to the device or data, potentially leading to confidentiality and integrity breaches in communication.
Recommendation
It is recommended to update the firmware of RS9116W and SiWx917 devices to a version that includes the fix. If not possible, restrict the use of legacy pairing and apply stronger authentication methods.
Other vulnerabilities in RS9116W/SiWx917
See all- CVE-2026-16769High
An unencrypted 'pause encryption request' message causes a denial of service in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper.
- CVE-2026-65936Medium
A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information.
- CVE-2026-16101High
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
Original NVD description (English source)
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS