Critical · published January 5, 2026
🚨 No authentication for Bluetooth connections in WHILL Model C2 Electric Wheelchairs and Model F Power Chairs makes them a playground for nearby attackers! 🔥 Think of it like leaving your car unlocked in a public parking lot — anyone can hop in and take it for a joyride without needing a key! These wheelchairs are essentially unguarded, allowing anyone nearby to commandeer them. An attacker could easily pair with the wheelchair and issue commands, overriding speed limits and altering movement settings. This could lead to potentially dangerous situations, putting users at risk as their mobility devices become puppets in the hands of malicious actors. Imagine someone suddenly racing at full speed without warning — absolutely devastating!
Think of it like leaving your car unlocked in a public parking lot — anyone can hop in and take it for a joyride without needing a key! These wheelchairs are essentially unguarded, allowing anyone nearby to commandeer them. This vulnerability allows unverified Bluetooth connections, letting attackers issue movement commands and change configurations without any credentials or user consent. The absence of proper authentication checks is what makes this flaw particularly concerning.
An attacker could easily pair with the wheelchair and issue commands, overriding speed limits and altering movement settings. This could lead to potentially dangerous situations, putting users at risk as their mobility devices become puppets in the hands of malicious actors. Imagine someone suddenly racing at full speed without warning — absolutely devastating! Users should immediately check for any firmware updates from WHILL that address this vulnerability. Additionally, consider disabling Bluetooth when not in use to mitigate the risk of unauthorized access until a patch is applied. You've got this! Stay vigilant and proactive, and you'll keep those wheelchairs safe and sound! 🛡️