https://vulnogram.org/ Most recent CVEs assigned by Silicon Labs (silabs). https://vulnogram.org/seaview/icons/silabs.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-15419 https://vulnogram.org/CVE-2026-15419 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges. High Thu, 10 Sep 2026 17:15:49 GMT https://vulnogram.org/CVE-2026-15418 https://vulnogram.org/CVE-2026-15418 In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earl… Low Thu, 10 Sep 2026 17:15:04 GMT https://vulnogram.org/CVE-2026-15417 https://vulnogram.org/CVE-2026-15417 In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash. Medium Thu, 10 Sep 2026 17:13:56 GMT https://vulnogram.org/CVE-2026-16769 https://vulnogram.org/CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below. High Tue, 08 Sep 2026 15:54:41 GMT https://vulnogram.org/CVE-2026-17610 https://vulnogram.org/CVE-2026-17610 In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread. Medium Thu, 27 Aug 2026 22:17:09 GMT https://vulnogram.org/CVE-2026-5706 https://vulnogram.org/CVE-2026-5706 In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provis… High Thu, 27 Aug 2026 22:13:56 GMT https://vulnogram.org/CVE-2026-65936 https://vulnogram.org/CVE-2026-65936 A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below. Medium Thu, 13 Aug 2026 14:26:23 GMT https://vulnogram.org/CVE-2026-65935 https://vulnogram.org/CVE-2026-65935 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below. High Thu, 13 Aug 2026 14:24:08 GMT https://vulnogram.org/CVE-2026-65934 https://vulnogram.org/CVE-2026-65934 An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below. High Thu, 13 Aug 2026 14:23:00 GMT https://vulnogram.org/CVE-2026-65933 https://vulnogram.org/CVE-2026-65933 A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below. Medium Thu, 13 Aug 2026 14:22:18 GMT https://vulnogram.org/CVE-2026-65932 https://vulnogram.org/CVE-2026-65932 The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below. Medium Thu, 13 Aug 2026 14:20:46 GMT https://vulnogram.org/CVE-2026-19293 https://vulnogram.org/CVE-2026-19293 SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below. High Thu, 13 Aug 2026 14:18:05 GMT https://vulnogram.org/CVE-2026-19292 https://vulnogram.org/CVE-2026-19292 Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below. High Thu, 13 Aug 2026 14:17:18 GMT https://vulnogram.org/CVE-2026-19291 https://vulnogram.org/CVE-2026-19291 Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below. High Thu, 13 Aug 2026 14:16:28 GMT https://vulnogram.org/CVE-2026-16101 https://vulnogram.org/CVE-2026-16101 Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below High Thu, 13 Aug 2026 14:15:39 GMT https://vulnogram.org/CVE-2026-6924 https://vulnogram.org/CVE-2026-6924 A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was al… High Network Exploitable Thu, 23 Jul 2026 21:05:22 GMT https://vulnogram.org/CVE-2026-4930 https://vulnogram.org/CVE-2026-4930 SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing). DPA Countermeasures on SYMCRYPTO can be weakened (reduced entropy) by for… High Thu, 25 Jun 2026 18:39:26 GMT https://vulnogram.org/CVE-2026-6432 https://vulnogram.org/CVE-2026-6432 Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would hav… Medium Thu, 25 Jun 2026 13:49:37 GMT https://vulnogram.org/CVE-2026-47154 https://vulnogram.org/CVE-2026-47154 In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no inf… High Thu, 25 Jun 2026 13:43:10 GMT https://vulnogram.org/CVE-2026-47153 https://vulnogram.org/CVE-2026-47153 In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control clus… High Thu, 25 Jun 2026 13:42:16 GMT https://vulnogram.org/CVE-2026-47152 https://vulnogram.org/CVE-2026-47152 In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control clus… High Thu, 25 Jun 2026 13:41:28 GMT https://vulnogram.org/CVE-2026-47151 https://vulnogram.org/CVE-2026-47151 In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the… High Thu, 25 Jun 2026 13:40:36 GMT https://vulnogram.org/CVE-2026-47150 https://vulnogram.org/CVE-2026-47150 In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already… High Thu, 25 Jun 2026 13:39:32 GMT https://vulnogram.org/CVE-2026-47149 https://vulnogram.org/CVE-2026-47149 In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leak… High Thu, 25 Jun 2026 13:38:40 GMT https://vulnogram.org/CVE-2026-47148 https://vulnogram.org/CVE-2026-47148 In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no inform… High Thu, 25 Jun 2026 13:37:36 GMT https://vulnogram.org/CVE-2026-47147 https://vulnogram.org/CVE-2026-47147 In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come… High Thu, 25 Jun 2026 13:36:36 GMT https://vulnogram.org/CVE-2026-47146 https://vulnogram.org/CVE-2026-47146 In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be imp… High Thu, 25 Jun 2026 13:35:41 GMT https://vulnogram.org/CVE-2026-47145 https://vulnogram.org/CVE-2026-47145 In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be imp… High Thu, 25 Jun 2026 13:34:48 GMT https://vulnogram.org/CVE-2026-4526 https://vulnogram.org/CVE-2026-4526 In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakag… High Thu, 25 Jun 2026 13:32:26 GMT https://vulnogram.org/CVE-2026-2815 https://vulnogram.org/CVE-2026-2815 Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys High Thu, 25 Jun 2026 13:27:45 GMT https://vulnogram.org/CVE-2026-8676 https://vulnogram.org/CVE-2026-8676 An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond. High Tue, 26 May 2026 19:36:53 GMT https://vulnogram.org/CVE-2025-14972 https://vulnogram.org/CVE-2025-14972 * Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. * KSU keys using SYMCRYPTO will be impacted by this vulnerability. Medium Fri, 15 May 2026 14:35:09 GMT https://vulnogram.org/CVE-2026-3290 https://vulnogram.org/CVE-2026-3290 Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values High Thu, 14 May 2026 19:24:26 GMT https://vulnogram.org/CVE-2025-11571 https://vulnogram.org/CVE-2025-11571 Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open executables. However, the commands cannot pass parameters or arguments. To successfully execute t… Low Network Exploitable Tue, 24 Mar 2026 16:26:32 GMT https://vulnogram.org/CVE-2025-14055 https://vulnogram.org/CVE-2025-14055 An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet. Low Fri, 20 Feb 2026 14:45:10 GMT https://vulnogram.org/CVE-2025-14547 https://vulnogram.org/CVE-2025-14547 An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service. Low Fri, 20 Feb 2026 14:11:05 GMT https://vulnogram.org/CVE-2026-0619 https://vulnogram.org/CVE-2026-0619 A reachable infinite loop via an integer wraparound is present in Silicon Labs' Matter SDK which allows an attacker to trigger a denial of service. A hard reset is required to recover the device. Medium Thu, 12 Feb 2026 20:09:28 GMT https://vulnogram.org/CVE-2025-11004 https://vulnogram.org/CVE-2025-11004 The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availabil… High Network Exploitable Tue, 10 Feb 2026 15:31:30 GMT https://vulnogram.org/CVE-2025-7432 https://vulnogram.org/CVE-2025-7432 DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys through a DPA attack. Low Mon, 09 Feb 2026 16:07:54 GMT https://vulnogram.org/CVE-2025-12131 https://vulnogram.org/CVE-2025-12131 A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. Medium Thu, 05 Feb 2026 20:02:24 GMT https://vulnogram.org/CVE-2025-7964 https://vulnogram.org/CVE-2025-7964 After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devic… Critical Network Exploitable Fri, 30 Jan 2026 15:02:53 GMT https://vulnogram.org/CVE-2025-10933 https://vulnogram.org/CVE-2025-10933 An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. Medium Mon, 05 Jan 2026 17:07:32 GMT https://vulnogram.org/CVE-2025-12986 https://vulnogram.org/CVE-2025-12986 When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet. The device may recover automatically or require a hard reset. Medium Thu, 04 Dec 2025 21:55:59 GMT https://vulnogram.org/CVE-2025-10285 https://vulnogram.org/CVE-2025-10285 The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password. High Thu, 04 Dec 2025 21:36:34 GMT https://vulnogram.org/CVE-2025-4321 https://vulnogram.org/CVE-2025-4321 In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation High Mon, 17 Nov 2025 14:58:33 GMT https://vulnogram.org/CVE-2025-10693 https://vulnogram.org/CVE-2025-10693 When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0… High Network Exploitable Fri, 31 Oct 2025 19:20:16 GMT https://vulnogram.org/CVE-2025-8414 https://vulnogram.org/CVE-2025-8414 Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a netw… Critical Fri, 17 Oct 2025 16:02:55 GMT https://vulnogram.org/CVE-2025-7448 https://vulnogram.org/CVE-2025-7448 Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack High Fri, 12 Sep 2025 09:11:53 GMT https://vulnogram.org/CVE-2025-1394 https://vulnogram.org/CVE-2025-1394 The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial of Service (DoS). Medium Wed, 30 Jul 2025 08:11:28 GMT https://vulnogram.org/CVE-2025-1221 https://vulnogram.org/CVE-2025-1221 A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system (CPCd) due to heavy Zigbee traffic, resulting in a Denial of Service (DoS) attack, Only hard reset will bring the device t… Medium Wed, 30 Jul 2025 08:09:19 GMT