EUVD-2026-67300
GHSA-p7h7-26v3-v26r
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network access with no authentication required; sole impact is device availability loss with no scope change to other systems.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
Lifecycle Timeline
1DescriptionCVE.org
In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread.
AnalysisAI
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, ACK packets are dropped, causing the device networking stack to fail and rendering the IoT endpoint unresponsive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions simultaneously: the target device must be an EFR32MG24 or EFR32MG26 microcontroller running SiSDK v2026.6.0 or earlier; the device must be explicitly configured for concurrent multiprotocol operation with both Zigbee and Thread active at the same time - single-protocol deployments are entirely unaffected; and the attacker must be able to generate or induce high network traffic loads on the shared adjacent wireless medium. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VA:H) signals adjacent-network, unauthenticated exploitation but with AT:P indicating a specific attack precondition - high traffic load - must be present, which raises the practical bar above a simple flood. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SiSDK to a version beyond 2026.6.0 using the patched release available at the vendor's GitHub repository (https://github.com/SiliconLabsSoftware/sisdk-release/tree/sisdk-2026.6); consult the vendor advisory for device-specific flashing procedures. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Predictable cryptographic key generation in Silicon Labs EFR32xG27 wireless SoCs stems from incorrect use of the on-chip
Improper bounds validation in Silicon Labs EmberZNet SDK versions 9.0.2 and earlier exposes Zigbee-connected devices to
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today