CVE-2026-16101

HighCVSS 8.8/10Last modified Oct 23, 2026

Description

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-161028.1A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCRCVE-2026-161034.3A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protecCVE-2026-161046.5A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat BuildCVE-2026-161054.9A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin RESTCVE-2026-161064.9A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated adminisCVE-2026-161075.9IBM TS4500 CLI tool Versions:  0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allCVE-2026-161086.5A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groupsCVE-2026-16116.4The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all vCVE-2026-161117.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allCVE-2026-1611710.0Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. FCVE-2026-161187.1A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file CVE-2026-161196.3A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec