Connect SDK CVE-2026-66279

The attacker must be within wireless/adjacent-network radio range of a device running Silicon Labs Connect SDK (<=4.3.1) or Flex SDK (<=3.7.7) - exploitation is not possible over the internet. The specific trigger is sending a protocol message with invalid security settings, which the stack mishandles to bypass authentication (CWE-940, improper verification of communication source); no authentication, credentials, or user interaction are required (PR:N/UI:N). LIMITING FACTORS: the attack requires physical proximity within the radio network (AV:A), which is the primary constraint on realistic risk; the flaw cannot recover the Network Key or decrypt traffic (confidentiality is explicitly unaffected), so impact is limited to network disruption (integrity/availability) rather than data compromise.

The input CVSS 4.0 vector (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N, base 7.2 High) is internally consistent with the description: AV:A means the attacker must be within radio/adjacent-network range (not internet-routable), PR:N/UI:N/AC:L/AT:N indicate an unauthenticated, low-complexity trigger with no user interaction, and the VC:N/VI:H/VA:H split matches the stated effect - authentication bypass causing network disruption with explicitly NO confidentiality loss (the Network Key is not exposed). No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no evidence of active exploitation; the only exploitation-weighted signal is the vendor's vuln.today priority 'this_week' (not act_now/emergency) plus an available patch. Net: this is a genuine but bounded priority - the adjacency requirement (physical radio proximity to the target wireless network) substantially caps real-world mass exploitation compared with a true network-vector flaw, and the impact is integrity/availability (disruption) rather than data theft. Treat as a plan-and-patch-this-week item, not a drop-everything emergency. Note the input CPE lists only Silicon Labs Connect SDK, while the description also names Flex SDK 3.7.7 and earlier - verify Flex SDK coverage in asset inventories.

An attacker positioned within wireless radio range of a Silicon Labs Connect SDK or Flex SDK network sends a message containing invalid security settings; the stack fails to properly verify it and bypasses authentication, letting the attacker inject traffic that disrupts network operation. Because PR:N/UI:N/AC:L, no credentials, user interaction, or complex preconditions are needed once the attacker is in radio range. No public exploit or PoC reference is present in the available sources.