CVE-2025-8414

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8414", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "state": "PUBLISHED", "assignerShortName": "Silabs", "dateReserved": "2025-07-31T13:35:54.376Z", "datePublished": "2025-10-17T16:02:55.583Z", "dateUpdated": "2025-10-17T17:20:32.188Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "SiSDK", "product": "Simplicity SDK", "repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "silabs.com", "versions": [{"lessThanOrEqual": "2025.6.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "2024.12.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "GSDK", "product": "Gecko SDK", "repo": "https://github.com/SiliconLabs/gsdk", "vendor": "silabs.com", "versions": [{"lessThanOrEqual": "4.4.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>Due to improper input validation, a buffer overflow vulnerability is present in \n\n<span style=\"background-color: rgb(255, 255, 255);\">Zigbee EZSP Host Applications</span>. If the buffer overflows, stack corruption is possible. In certain</div><div>conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.&nbsp;<br></div>"}], "value": "Due to improper input validation, a buffer overflow vulnerability is present in \n\nZigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain\n\nconditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2025-10-17T16:02:55.583Z"}, "references": [{"tags": ["vendor-advisory", "permissions-required"], "url": "https://community.silabs.com/068Vm00000WJZED"}], "source": {"discovery": "UNKNOWN"}, "title": "Zigbee Green Power Host Buffer Overflow Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-17T17:19:58.824957Z", "id": "CVE-2025-8414", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T17:20:32.188Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8414", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T17:19:58.824957Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T17:20:22.402Z"}}], "cna": {"title": "Zigbee Green Power Host Buffer Overflow Vulnerability", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "silabs.com", "product": "Simplicity SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.6.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2024.12.2"}], "packageName": "SiSDK", "defaultStatus": "unaffected"}, {"repo": "https://github.com/SiliconLabs/gsdk", "vendor": "silabs.com", "product": "Gecko SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.4.6"}], "packageName": "GSDK", "defaultStatus": "unaffected"}], "references": [{"url": "https://community.silabs.com/068Vm00000WJZED", "tags": ["vendor-advisory", "permissions-required"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Due to improper input validation, a buffer overflow vulnerability is present in \n\nZigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain\n\nconditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<div>Due to improper input validation, a buffer overflow vulnerability is present in \n\n<span style=\"background-color: rgb(255, 255, 255);\">Zigbee EZSP Host Applications</span>. If the buffer overflows, stack corruption is possible. In certain</div><div>conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.&nbsp;<br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2025-10-17T16:02:55.583Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8414", "state": "PUBLISHED", "dateUpdated": "2025-10-17T17:20:32.188Z", "dateReserved": "2025-07-31T13:35:54.376Z", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "datePublished": "2025-10-17T16:02:55.583Z", "assignerShortName": "Silabs"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "SiSDK", "product": "Simplicity SDK", "repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "silabs.com", "versions": [{"lessThanOrEqual": "2025.6.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "2024.12.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "GSDK", "product": "Gecko SDK", "repo": "https://github.com/SiliconLabs/gsdk", "vendor": "silabs.com", "versions": [{"lessThanOrEqual": "4.4.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@silabs.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to improper input validation, a buffer overflow vulnerability is present in \n\nZigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain\n\nconditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability."}, {"lang": "es", "value": "Debido a una validaci\u00f3n de entrada incorrecta, una vulnerabilidad de desbordamiento de b\u00fafer est\u00e1 presente en las aplicaciones host Zigbee EZSP. Si el b\u00fafer se desborda, la corrupci\u00f3n de la pila es posible. En ciertas condiciones, esto podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario. Se requiere acceso a una clave de red para explotar esta vulnerabilidad."}], "id": "CVE-2025-8414", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-security@silabs.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8414", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-17T17:19:58.824957Z", "version": "2.0.3"}}]}, "published": "2025-10-17T16:15:39.413", "references": [{"source": "product-security@silabs.com", "url": "https://community.silabs.com/068Vm00000WJZED"}], "sourceIdentifier": "product-security@silabs.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "product-security@silabs.com", "type": "Secondary"}]}

{}

{"created": "2025-10-20T13:22:02.476986+00:00", "updated": "2025-10-20T13:22:02.477025+00:00", "vendors": ["silabs", "silabs$PRODUCT$gecko_sdk", "silabs$PRODUCT$simplicity_sdk"]}