Which versions of Simplicity SDK are affected by CVE-2026-4930?

Silicon Labs SiXG301 cryptographic hardware engines embedded in your deployed systems have weakened key-protection mechanisms that allow attackers with device access and code execution privileges to…

How to fix or mitigate CVE-2026-4930?

24 hours: Identify all deployed systems using Silicon Labs SiXG301 SYMCRYPTO engine via product documentation and BOM review. 7 days: Audit physical security, network segmentation, and endpoint protection for identified systems; implement EDR or equivalent to block on-device code execution. 30 days: Evaluate replacement options or device decommissioning for high-risk deployments; escalate Silicon Labs advisory to product teams for long-term remediation strategy.

Simplicity SDK CVE-2026-4930

Q: What is the CVSS score of CVE-2026-4930?

CVE-2026-4930 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-39534 HIGH

Insufficient Entropy (CWE-331)

2026-06-25 Silabs

GHSA-7ccr-fw66-p8jj

RCE Simplicity Sdk Silabs Com

7.1

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

7.1 HIGH

CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Physical access for power traces (AV:P), prior code execution (PR:H), and DPA expertise/equipment (AC:H); only key confidentiality is impacted (C:H) and extracted keys affect other systems (S:C).

3.1 AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:P/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 19:16 vuln.today

DescriptionCVE.org

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing).

DPA Countermeasures on SYMCRYPTO can be weakened (reduced entropy) by forcing certain seed values if an attacker gains code execution capability on the impacted device.

Therefore, the keys loaded on SYMCRYPTO may be more vulnerable to extraction through DPA attacks than intended

AnalysisAI

Reduced cryptographic key protection in Silicon Labs' SiXG301 SYMCRYPTO hardware engine (exposed via the Simplicity SDK PSA crypto library) allows an attacker who already has on-device code execution to weaken the engine's Differential Power Analysis (DPA) countermeasures by forcing low-entropy seed values, making AES/hashing keys far easier to recover through subsequent power-analysis side-channel attacks. The flaw affects embedded systems built on the SiXG301 SoC and was reported by Silicon Labs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation also requires physical access to the device for the power measurements.

Technical ContextAI

SYMCRYPTO is the host-side hardware accelerator on the SiXG301 system-on-chip that offloads symmetric cryptography (AES encryption/decryption and hashing) and is driven through the PSA Crypto API in the Simplicity SDK. To resist side-channel key recovery, the engine implements DPA countermeasures - typically randomized masking driven by a seed/entropy source so that instantaneous power consumption is decorrelated from secret key material. This issue maps to CWE-331 (Insufficient Entropy): an attacker with code execution can pin or force the seed values feeding those countermeasures, collapsing the randomness so the masking no longer effectively hides key-dependent power signatures. With the countermeasures degraded, classic DPA - statistically correlating many power traces against key hypotheses - becomes practical against keys loaded into SYMCRYPTO. The affected component is identified by cpe:2.3:a:silabs.com:simplicity_sdk:*:*:*:*:*:*:*:* (all versions per available data).

RemediationAI

No vendor-released patch version is identified in the available data; consult the Silicon Labs advisory at https://community.silabs.com/068Vm00000sjHs3 for the official fix and apply the vendor-recommended SDK/firmware update for the SiXG301 once a fixed version is published. Because exploitation requires prior on-device code execution, the highest-value compensating control is hardening against that precondition: enforce secure boot and signed-firmware verification so attacker code cannot run, and lock debug/JTAG/SWD interfaces in production (trade-off: complicates field diagnostics and RMA debugging). Restrict and monitor physical access to deployed devices and consider tamper-evident or tamper-resistant enclosures, since DPA requires physical power-trace capture (trade-off: cost and enclosure design effort). Where supported, rotate keys and avoid loading long-lived high-value master keys into SYMCRYPTO on devices that may be physically exposed (trade-off: key-management overhead). These reduce but do not eliminate risk until the vendor entropy fix is applied.