Spoofing Attack Forces Re-Pairing in RS9116W and SiWx917

Executive Summary

CVE-2026-16101 is a Bluetooth Low Energy (BLE) re-pairing vulnerability affecting Silicon Labs SiWx91x and RS9116W devices. An attacker can spoof a bonded device to force a re-pairing process with a rogue device, potentially allowing unauthorized access or data interception.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves BLE re-pairing attacks where an attacker spoofs a bonded device to force re-pairing with a rogue device. Detection requires monitoring BLE pairing processes and encryption key sizes. Use tools like Wireshark with BLE protocol filters to inspect SMP messages during pairing. Check if devices accept weak encryption keys (less than 7 bytes) during re-pairing attempts. Silicon Labs provides the rsi_ble_vendor_set_SMP_min_enc_keysize API to enforce minimum key sizes in SDK versions 4.1.0 and later.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables impersonation and Man-in-the-Middle attacks. Attackers could intercept or manipulate BLE communications, leading to unauthorized access to sensitive data or control of paired devices. The impact includes potential data breaches or device hijacking.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables impersonation and Man-in-the-Middle attacks during BLE re-pairing, potentially exposing sensitive data. For GDPR, this could lead to unauthorized access to personal data, violating principles of data protection and user consent. Under HIPAA, it risks exposing protected health information during transmission, compromising integrity and confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Silicon Labs SiWx91x Bluetooth LE SDK to version 4.1.0 or later. Use the rsi_ble_vendor_set_SMP_min_enc_keysize API to enforce minimum encryption key sizes between 7 and 16 bytes during BLE pairing processes.

Useful 0 Not Useful 0