The Patching Friars' AlmanacA calendar of CVE saints

January 5

WHILLHoly card for whill-wheelchair, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 WHILL QUIVIS PARIATUR
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint WHILL, Who Paired With Anyone

Patron of Bluetooth without passwords, overly friendly remote controls, and speed limits that unlock themselves.

Life

On 5 January 2026 CVE-2025-14346, tied to a late-December CISA advisory, revealed that WHILL Model C2 and Model F power chairs required no authentication over Bluetooth. Researchers at QED Secure Solutions showed that anyone within a few metres could pair, send movement commands, override speed limits and change configuration profiles, with no credentials and without the user touching a thing. Score: 9.8.

Prayer

O Saint WHILL, who said yes to every device, teach our gadgets to ask who is knocking before they open. Amen.

How to celebrate

Celebrated by following the vendor's advisory and remembering that a movement command deserves at least a password.

Technical record

Disclosed on
January 5 2026
CVE
CVE-2025-14346
CVSS
9.8
Product
WHILL · Model C2 Electric Wheelchair

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.

Sources: nvd.nist.gov

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.