CVE-2026-19292

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19292", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "state": "PUBLISHED", "assignerShortName": "Silabs", "dateReserved": "2026-08-07T16:21:05.493Z", "datePublished": "2026-08-13T14:17:18.403Z", "dateUpdated": "2026-08-13T17:03:49.758Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2026-08-13T14:17:18.403Z"}, "title": "Bluetooth re-pairing with legitimate device can use lower security level", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-305", "description": "CWE-305 Authentication bypass by primary weakness", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "silabs.com", "product": "WiseConnect", "packageName": "SiSDK", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.1.0", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.14.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Re-pairing with a legitimate device can use a lower security level than\nprevious making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Re-pairing with a legitimate device can use a lower security level than\nprevious making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.</span><br>"}]}], "references": [{"url": "https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes", "tags": ["release-notes"]}, {"url": "https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes", "tags": ["release-notes"]}, {"url": "https://community.silabs.com/068Vm00000x0yyH", "tags": ["vendor-advisory", "permissions-required"]}, {"url": "https://www.ndss-symposium.org/ndss-paper/blerp-ble-re-pairing-attacks-and-defenses/", "tags": ["related"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T17:02:15.321784Z", "id": "CVE-2026-19292", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:03:49.758Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19292", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T17:02:15.321784Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:03:07.661Z"}}], "cna": {"title": "Bluetooth re-pairing with legitimate device can use lower security level", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "silabs.com", "product": "WiseConnect", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.1.0", "versionType": "semver"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.14.0", "versionType": "semver"}], "packageName": "SiSDK", "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes", "tags": ["release-notes"]}, {"url": "https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes", "tags": ["release-notes"]}, {"url": "https://community.silabs.com/068Vm00000x0yyH", "tags": ["vendor-advisory", "permissions-required"]}, {"url": "https://www.ndss-symposium.org/ndss-paper/blerp-ble-re-pairing-attacks-and-defenses/", "tags": ["related"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Re-pairing with a legitimate device can use a lower security level than\nprevious making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.", "supportingMedia": [{"type": "text/html", "value": "<span>Re-pairing with a legitimate device can use a lower security level than\nprevious making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305 Authentication bypass by primary weakness"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2026-08-13T14:17:18.403Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19292", "state": "PUBLISHED", "dateUpdated": "2026-08-13T17:03:49.758Z", "dateReserved": "2026-08-07T16:21:05.493Z", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "datePublished": "2026-08-13T14:17:18.403Z", "assignerShortName": "Silabs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "SiSDK", "product": "WiseConnect", "vendor": "silabs.com", "versions": [{"lessThan": "4.1.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "2.14.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "product-security@silabs.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Re-pairing with a legitimate device can use a lower security level than\nprevious making brute-forcing the LTK easier. See V4 in the BLERP paper linked below."}, {"lang": "es", "value": "Re-emparejar con un dispositivo leg\u00edtimo puede usar un nivel de seguridad inferior al anterior, lo que facilita el ataque de fuerza bruta al LTK. V\u00e9ase V4 en el documento BLERP enlazado a continuaci\u00f3n."}], "id": "CVE-2026-19292", "lastModified": "2026-10-23T18:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "product-security@silabs.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19292", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T17:02:15.321784Z", "version": "2.0.3"}}]}, "published": "2026-08-13T15:19:37.737", "references": [{"source": "product-security@silabs.com", "url": "https://community.silabs.com/068Vm00000x0yyH"}, {"source": "product-security@silabs.com", "url": "https://docs.silabs.com/rs9116-wiseconnect/latest/wifibt-wc-release-notes/rs9116-ble-release-notes#bug-fixes"}, {"source": "product-security@silabs.com", "url": "https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wifi-release-notes/sisdk-wifible-ble-release-notes"}, {"source": "product-security@silabs.com", "url": "https://www.ndss-symposium.org/ndss-paper/blerp-ble-re-pairing-attacks-and-defenses/"}], "sourceIdentifier": "product-security@silabs.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "product-security@silabs.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.14.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WiseConnect", "source": "cna", "vendor": "silabs.com"}, "product": "wiseconnect", "vendor": "silabs.com"}], "created": "2026-08-13T15:30:04.384924+00:00", "updated": "2026-08-14T09:31:28.766955+00:00", "vendors": ["silabs.com", "silabs.com$PRODUCT$wiseconnect"]}