The flaw allows an attacker to skip the required passkey during Bluetooth LE legacy pairing by altering the temporary key value. This violation of the expected authentication protocol means a malicious device can pair without user consent, potentially gaining privileged access to the target’s services or data. The weakness is classified as a compromised authentication process.

The vulnerability affects Silabs WiseConnect devices that use the RS9116W or SiWx917 chipsets. These chips are used in various low‑power IoT applications that rely on BLE legacy pairing for initial setup or maintenance.

The CVSS score of 7.6 marks this as high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need proximity to the target device’s wireless interface to manipulate the temporary key over BLE. Once successful, the attacker can pair and create a data channel or execute commands as if a legitimate user had granted the connection.