CVE-2026-4930

DPA Countermeasures weakening on Series 3 devices

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing). DPA Countermeasures on SYMCRYPTO can be weakened (reduced entropy) by forcing certain seed values if an attacker gains code execution capability on the impacted device. * Therefore, the keys loaded on SYMCRYPTO may be more vulnerable to extraction through DPA attacks than intended

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Sdk

CVE-2026-8676

Bluetooth LE Bonding Downgrade via Spoofing

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Sdk

CVE-2025-14972

Insufficient DPA countermeasure reseeding

* Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. * KSU keys using SYMCRYPTO will be impacted by this vulnerability.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Sdk

CVE-2025-14055

Integer underflow in Secure NCP host

An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Sdk

CVE-2025-7964

Zigbee Router Denial of Service

After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices will be unable to rejoin. A manual recommissioning is required to recover the Zigbee Router.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Zigbee Stack

CVE-2025-8414

Zigbee Green Power Host Buffer Overflow Vulnerability

Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Gecko Sdk Simplicity Sdk

CVE-2025-7432

DPA countermeasures not reseeded under certain conditions

DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions.  This may allow an attacker to eventually extract secret keys through a DPA attack.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Sdk

CVE-2025-7448

Man in the middle (MitM) attack vulnerability in Wi-SUN library

Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Wi-sun Stack

CVE-2025-14547

ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIs

An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Gecko Sdk Simplicity Sdk

CVE-2025-12986

Denial of Service Vulnerability in Silicon Labs WF200 and WGM160P Devices

When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet. The device may recover automatically or require a hard reset.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Wf200 Wgm160p

CVE-2025-1394

Denial of Service (DoS) vulnerabilitiey in Zigbee library

The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial of Service (DoS).

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Emberznet

CVE-2025-1221

DoS in Zigbee device due to heavy traffic

A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system (CPCd) due to heavy Zigbee traffic, resulting in a Denial of Service (DoS) attack, Only hard reset will bring the device to normal operation

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Emberznet

CVE-2025-10933

Silicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds read

An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Z-wave Protocol Controller

CVE-2025-11004

Reflected XSS vulnerability in Simplicity Device Manager tool

The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device Manager tool running in the background.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Device Manager

CVE-2025-10285

Simplcity Device Manager exposes NTLMv2 hash

The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Simplicity Device Manager

CVE-2025-10693

Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure

When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0 and v2025.6.1.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Z-wave Sdk

CVE-2024-3017

Denial of service in multi-protocol gateway - Zigbee + Thread

In a Silicon Labs  multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (RCP) causes the OpenThread Border Router(OTBR) application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Sisdk

CVE-2024-3051

Z/IP Gateway Device Reset Locally Denial of Service Vulnerability

Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Z\/ip Gateway Sdk

CVE-2023-51391

Micrium OS Network uC-HTTP server header parsing invalid pointer dereference vulnerability

A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Gecko Software Development Kit

CVE-2023-51395

Z-Wave S0 Decryption Vulnerability in End Devices

The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Z-wave Software Development Kit