Which versions of EFR32xG27 are affected by CVE-2026-2815?

Silicon Labs' EFR32xG27 wireless SoC contains a flaw in key generation that could allow nearby attackers to intercept or forge wireless communications on devices using affected firmware.. A patch is available.

How to fix or mitigate CVE-2026-2815?

24 hours: Inventory all devices using EFR32xG27 SoCs and identify current SiSDK firmware versions in production; contact Silicon Labs for patch availability and compatibility assessment. 7 days: Obtain patched SiSDK firmware from Silicon Labs; test in non-production environment; develop deployment and rollback procedures. 30 days: Deploy patched firmware to all affected production systems; verify successful updates across inventory; document remediation completion.

EFR32xG27 CVE-2026-2815

Q: What is the CVSS score of CVE-2026-2815?

CVE-2026-2815 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39394 HIGH

Small Seed Space in PRNG (CWE-339)

2026-06-25 Silabs

GHSA-f2cj-j66g-55wj

Information Disclosure Sisdk Silicon Labs

8.4

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

8.4 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Adjacent radio attack with no privileges/UI; predictable keys break confidentiality and enable device impersonation (I:H) affecting downstream connected systems, hence scope change S:C; no availability impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:28 vuln.today

DescriptionCVE.org

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys

AnalysisAI

Predictable cryptographic key generation in Silicon Labs EFR32xG27 wireless SoCs stems from incorrect use of the on-chip PUF (Physical Unclonable Function) when deriving user keys, allowing an adjacent attacker to anticipate or reconstruct keys that should be unique and secret. Affected firmware built with the Silicon Labs SiSDK loses the confidentiality and authentication guarantees of derived keys. No public exploit identified at time of analysis; the issue was self-reported by Silicon Labs and a vendor patch is available.

Technical ContextAI

EFR32xG27 is a Series 2 wireless SoC from Silicon Labs used in Bluetooth/Zigbee/Thread/proprietary IoT designs, and the affected component per the CPE (cpe:2.3:a:silicon_labs:sisdk) is the Silicon Labs SiSDK software stack. A PUF leverages manufacturing-level physical variations to produce a device-unique secret intended to seed key derivation. The defect maps to CWE-339 (Small Seed Space in a PRNG / predictable seed): because the PUF output is consumed incorrectly during user key generation, the effective entropy of derived keys collapses, making them guessable rather than unique-per-device. The root cause is therefore not a weak algorithm but an implementation flaw in how the high-entropy PUF source is fed into key derivation.

RemediationAI

Apply the Silicon Labs fix by updating to the patched SiSDK from the official release repository (https://github.com/SiliconLabsSoftware/sisdk-release) and consult the vendor advisory (https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000kDYsfIAG?operationContext=S1) for the exact fixed version and any required key re-provisioning steps - the input confirms a patch is available but does not name an exact fixed version, so verify it in the advisory rather than assuming. Because the defect produces predictable keys, patching firmware is necessary but likely not sufficient: any user keys already generated on the vulnerable path should be treated as compromised and regenerated/re-provisioned after updating, which may require re-flashing or re-pairing fielded devices (trade-off: operational disruption and possible need for physical or OTA access to deployed units). If immediate patching is impossible, restrict device pairing/provisioning to trusted, controlled environments and minimize exposure of devices to untrusted adjacent radio range, accepting that this reduces but does not eliminate the predictable-key risk.