CVE-2026-65936

The CVSS 5.3 score for this Bluetooth firmware information disclosure is dangerously misleading for deployments where RS9116W or SiWx917 silicon is present — and you should treat it as significantly higher than the number suggests. The vulnerability allows malformed Bluetooth connection requests to trigger disclosure of potentially sensitive firmware state information. The score treats this as a standalone medium-severity finding. It is almost certainly not standalone, and the severity depends on device-specific context that CVSS cannot express. The core problem is structural: CVSS assumes 'apply the patch' is a viable remediation path. For embedded silicon, it often is not. You cannot patch deployed RS9116W devices without hardware replacement or rare OTA firmware updates that many IoT manufacturers never control — the silicon vendor holds the signing keys, not the OEM. This means the exploitation window is potentially permanent across millions of deployed units in industrial, medical, and smart building environments. The EPSS score of 0.00178 reflects the absence of remote exploitation, not the absence of high-confidence exploitation against valuable targets in range. The 'potentially sensitive' qualifier in the official description is a diagnostic of deeper uncertainty. Firmware binaries accumulate sediment: debug strings, legacy command handlers, deprecated authentication tokens, manufacturing test modes that were never removed. An information disclosure at the firmware layer doesn't just leak what the device is currently using — it leaks the entire memory footprint of the stack, including code paths that exist but are 'unreachable' from current operation. That word does significant work. Deprecated command handlers don't get called by current firmware logic, but they remain compiled into the binary and resident in memory; an attacker with the right malformed request can sometimes invoke them directly because the parser hasn't changed, only the calling code has. The proximity constraint that keeps EPSS low works for consumer devices in uncontrolled environments but collapses in high-value deployments. A manufacturing facility with RS9116W-powered sensors has overlapping Bluetooth range across an entire floor — an attacker who gains facility access faces no proximity barrier. Hospital wards with medical IoT have similar spatial concentration. Industrial threat models that account for contractor access, tenant turnover, or BYOD threats cannot treat proximity as a meaningful barrier. Treat this as one node in a likely attack graph. The reference to 'vulnerability B-E4' in related research suggests this is part of a coordinated disclosure. Check whether the full paper describes exploit chains that combine this information leak with other findings to escalate to command injection, authentication bypass, or authenticated actions. An info disclosure that scores medium in isolation becomes strategically critical if it feeds into other vulnerabilities from the same disclosure. For devices that cannot be patched, your operational response should be: assume the worst-case memory footprint was exposed, implement network segmentation to isolate affected devices, monitor for malformed Bluetooth connection requests targeting the RS9116W stack, and treat the proximity boundary as permeable in any environment where unauthorized physical access is a plausible threat model.

Reviewed through automated stages and approved by a human before publication.