Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 126

Export CSV
CVE-2023-4280

Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region

An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit
CVE-2023-5138

Glitch detection not active by default in Silicon Labs Secure Vault High devices

Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit
CVE-2023-4489

Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key

The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction and unauthorized S0 network access.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Z\/ip Gateway Sdk
CVE-2023-6387

Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow

A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit
CVE-2022-24942

Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution

Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request.

CVSS 3.1 · 9.1 Critical EPSS 2.4% KEV · Not listed
Vendors
Silabs
Products
Micrium Uc-http
CVE-2022-24936

Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices

Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Bootloader
CVE-2022-24938

Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earlier

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Emberznet
CVE-2022-24937

Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Emberznet
CVE-2022-24939

Malformed Zigbee packet with invalid destination address causes Assert

 A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit Zigbee Emberznet
CVE-2023-41097

Potential Timing vulnerability in CBC PKCS7 padding calculations

An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit
CVE-2023-51392

Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM

Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Emberznet
CVE-2023-51393

Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer

Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault and crash of the device, requiring a reboot in order to rejoin the network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Emberznet Emberznet Sdk
CVE-2021-27411

Micrium OS Integer Overflow or Wraparound

Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Micrium Os
CVE-2023-1261

Missing MAC layer security in Wi-SUN SDK

Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Wi-sun Software Development Kit
CVE-2023-0775

Bluetooth LE Invalid prepare write request command leads to denial of service

An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests, resulting in a denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit
CVE-2023-51394

Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash

High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Emberznet
CVE-2023-6533

Silicon Labs PC Controller Denial of Service Vulnerability

Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and earlier.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Z-wave Pc-based Controller
CVE-2024-22473

Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices

TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Gecko Software Development Kit
CVE-2023-6640

Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability

Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs
Products
Z-wave Pc-based Controller