CVE-2026-6924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6924", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "state": "PUBLISHED", "assignerShortName": "Silabs", "dateReserved": "2026-04-23T17:11:02.116Z", "datePublished": "2026-07-23T21:05:22.113Z", "dateUpdated": "2026-07-24T13:40:36.220Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2026-07-23T21:05:22.113Z"}, "title": "Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-336", "description": "CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-97", "descriptions": [{"lang": "en", "value": "CAPEC-97: Cryptanalysis"}]}], "affected": [{"vendor": "Silicon Labs", "product": "Silicon Labs Matter Github", "repo": "https://github.com/SiliconLabs/simplicity_sdk", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated."}]}], "references": [{"url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/a45Vm0000009SzZIAU?operationContext=S1", "tags": ["vendor-advisory", "permissions-required"]}, {"url": "https://github.com/SiliconLabs/matter/tree/release_2.3.1-1.3", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Junming C. (@Chapoly1305) and Prof. Qiang Zeng of George Mason University", "type": "reporter"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-24T13:40:22.863000Z", "id": "CVE-2026-6924", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T13:40:36.220Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T13:40:22.863000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-24T13:40:29.288Z"}}], "cna": {"title": "Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Junming C. (@Chapoly1305) and Prof. Qiang Zeng of George Mason University"}], "impacts": [{"capecId": "CAPEC-97", "descriptions": [{"lang": "en", "value": "CAPEC-97: Cryptanalysis"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "Silicon Labs", "product": "Silicon Labs Matter Github", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/a45Vm0000009SzZIAU?operationContext=S1", "tags": ["vendor-advisory", "permissions-required"]}, {"url": "https://github.com/SiliconLabs/matter/tree/release_2.3.1-1.3", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.", "supportingMedia": [{"type": "text/html", "value": "A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-336", "description": "CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)"}]}], "providerMetadata": {"orgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "shortName": "Silabs", "dateUpdated": "2026-07-23T21:05:22.113Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6924", "state": "PUBLISHED", "dateUpdated": "2026-07-24T13:40:36.220Z", "dateReserved": "2026-04-23T17:11:02.116Z", "assignerOrgId": "030b2754-1501-44a4-bef8-48be86a33bf4", "datePublished": "2026-07-23T21:05:22.113Z", "assignerShortName": "Silabs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Silicon Labs Matter Github", "repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "Silicon Labs", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}]}], "source": "product-security@silabs.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated."}, {"lang": "es", "value": "Un error en la inicializaci\u00f3n de la entrop\u00eda para SiWx917 provoca que el DRBG utilice una semilla predecible. Como tal, todos los n\u00fameros aleatorios generados en el c\u00f3digo de Matter utilizan la misma secuencia de n\u00fameros. Esta vulnerabilidad fue descubierta despu\u00e9s de que el repositorio afectado ya hab\u00eda sido desaprobado."}], "id": "CVE-2026-6924", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-security@silabs.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6924", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-24T13:40:22.863000Z", "version": "2.0.3"}}]}, "published": "2026-07-23T21:17:05.447", "references": [{"source": "product-security@silabs.com", "url": "https://github.com/SiliconLabs/matter/tree/release_2.3.1-1.3"}, {"source": "product-security@silabs.com", "url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/a45Vm0000009SzZIAU?operationContext=S1"}], "sourceIdentifier": "product-security@silabs.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-336"}], "source": "product-security@silabs.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Silicon Labs Matter Github", "source": "cna", "vendor": "Silicon Labs"}, "product": "silicon_labs_matter_github", "vendor": "silicon_labs"}], "created": "2026-07-26T04:15:02.921178+00:00", "updated": "2026-08-03T21:00:12.555729+00:00", "vendors": ["silicon_labs", "silicon_labs$PRODUCT$silicon_labs_matter_github"]}