CVE-2026-16101

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
silabs.comWiseConnect>= 4.0.0, < 4.1.0; >= 2.0.0, < 2.14.0

References

Timeline

Published
Aug 13, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-161028.1A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCRCVE-2026-161034.3A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protecCVE-2026-161046.5A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat BuildCVE-2026-161054.9A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin RESTCVE-2026-161064.9A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated adminisCVE-2026-161075.9IBM TS4500 CLI tool Versions:  0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allCVE-2026-161086.5A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groupsCVE-2026-16116.4The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all vCVE-2026-161117.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allCVE-2026-1611710.0Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. FCVE-2026-161187.1A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file CVE-2026-161196.3A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec
CVE-2026-16101: High severity, CVSS 8.8 | Vulnix