Silabs Com
Monthly
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation is bounded by Bluetooth radio adjacency.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to negotiate a lower security level during the re-pairing process with an already-bonded peer, effectively bypassing the previously established security guarantees. Documented as the 'V3' attack variant in the NDSS-published BLERP (BLE Re-Pairing) research paper, this flaw enables high-impact compromise of confidentiality, integrity, and availability across affected WiseConnect firmware lines. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the NDSS publication constitutes academic proof-of-concept disclosure.
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to spoof a previously bonded device and force the target to re-bond with a rogue device, yielding full BLE session control. Both WiseConnect SDK 2.x (before 2.14.0) and 4.x (before 4.1.0) are confirmed affected per vendor release notes and the academic BLERP (BLE Re-Pairing Attacks and Defenses) paper published at NDSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the NDSS paper provides a detailed methodology that could guide motivated researchers to weaponize the technique.
Reduced cryptographic key protection in Silicon Labs' SiXG301 SYMCRYPTO hardware engine (exposed via the Simplicity SDK PSA crypto library) allows an attacker who already has on-device code execution to weaken the engine's Differential Power Analysis (DPA) countermeasures by forcing low-entropy seed values, making AES/hashing keys far easier to recover through subsequent power-analysis side-channel attacks. The flaw affects embedded systems built on the SiXG301 SoC and was reported by Silicon Labs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation also requires physical access to the device for the power measurements.
Bluetooth LE bond downgrade in Silicon Labs Simplicity SDK allows an adjacent attacker to weaken connection security by deleting an existing bond, impersonating the previously bonded peer, and forcing a new pairing under attacker-controlled parameters. The flaw enables compromise of confidentiality, integrity, and availability of BLE communications on devices built with the affected SDK, and no public exploit has been identified at time of analysis.
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sensitive data to adjacent Bluetooth attackers. A specially crafted malformed Bluetooth connection request triggers a buffer over-read (CWE-126), causing the device to leak memory contents to the attacker without any authentication requirement. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Memory disclosure in the Silicon Labs BT122 Bluetooth module allows unauthenticated adjacent attackers to leak potentially sensitive device memory by sending a malformed Bluetooth connection request. The root cause is a buffer over-read (CWE-126) in the firmware's connection request parser, identified as finding B-E4 in academic research published on arXiv (2409.02905). No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is constrained by Bluetooth radio range and the niche embedded deployment footprint of the BT122.
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A command injection vulnerability exists in Silicon Labs Simplicity Studio V5 and Simplicity Installer Tool for Simplicity Studio V6, where vulnerable endpoints accept user-controlled input through URLs in JSON format, enabling arbitrary command execution. An attacker on the same network can exploit this to execute system commands, though parameter passing is restricted. While CVSS scoring is unavailable, the vulnerability represents a significant local network threat to development environments using these tools.
Denial of service in Silicon Labs RS9116W/SiWx917 wireless modules running WiSeConnect 2.x allows an adjacent unauthenticated attacker to crash or disable the wireless stack by sending a crafted, unencrypted 'pause encryption request' management frame. The device incorrectly accepts and acts on this unauthenticated control message without verifying that it is protected by the session encryption, violating the expected security contract (CWE-440). This vulnerability was documented as finding B-E10 in a published academic research paper (arXiv:2409.02905), indicating it was discovered through systematic protocol-level analysis of Wi-Fi chipset behavior. No public exploit code or KEV listing is known at time of analysis.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation is bounded by Bluetooth radio adjacency.
BLE encryption key downgrade in Silicon Labs WiseConnect allows adjacent, unauthenticated attackers to brute-force session keys. When a peripheral initiates SMP (Security Manager Protocol) pairing, WiseConnect's security request omits the device's maximum supported encryption key size. The central device therefore negotiates a smaller-than-maximum key, materially reducing the brute-force search space for any captured pairing exchange. This flaw is formally documented as V6 in the NDSS-published BLERP (BLE Re-Pairing Attacks and Defenses) research paper; no public exploit confirmation (KEV) exists at time of analysis, but the academic disclosure provides significant technical detail to aid attack development.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
Bluetooth Low Energy re-pairing in Silicon Labs RS9116W and SiWx91x devices allows a nearby unauthenticated attacker to negotiate a lower security level during the re-pairing process with an already-bonded peer, effectively bypassing the previously established security guarantees. Documented as the 'V3' attack variant in the NDSS-published BLERP (BLE Re-Pairing) research paper, this flaw enables high-impact compromise of confidentiality, integrity, and availability across affected WiseConnect firmware lines. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the NDSS publication constitutes academic proof-of-concept disclosure.
BLE re-pairing attacks against Silicon Labs RS9116W and SiWx917 modules allow an adjacent unauthenticated attacker to spoof a previously bonded device and force the target to re-bond with a rogue device, yielding full BLE session control. Both WiseConnect SDK 2.x (before 2.14.0) and 4.x (before 4.1.0) are confirmed affected per vendor release notes and the academic BLERP (BLE Re-Pairing Attacks and Defenses) paper published at NDSS. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though the NDSS paper provides a detailed methodology that could guide motivated researchers to weaponize the technique.
Reduced cryptographic key protection in Silicon Labs' SiXG301 SYMCRYPTO hardware engine (exposed via the Simplicity SDK PSA crypto library) allows an attacker who already has on-device code execution to weaken the engine's Differential Power Analysis (DPA) countermeasures by forcing low-entropy seed values, making AES/hashing keys far easier to recover through subsequent power-analysis side-channel attacks. The flaw affects embedded systems built on the SiXG301 SoC and was reported by Silicon Labs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation also requires physical access to the device for the power measurements.
Bluetooth LE bond downgrade in Silicon Labs Simplicity SDK allows an adjacent attacker to weaken connection security by deleting an existing bond, impersonating the previously bonded peer, and forcing a new pairing under attacker-controlled parameters. The flaw enables compromise of confidentiality, integrity, and availability of BLE communications on devices built with the affected SDK, and no public exploit has been identified at time of analysis.
Information disclosure in Silicon Labs RS9116W and SiWx917 wireless modules running WiseConnect exposes potentially sensitive data to adjacent Bluetooth attackers. A specially crafted malformed Bluetooth connection request triggers a buffer over-read (CWE-126), causing the device to leak memory contents to the attacker without any authentication requirement. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Memory disclosure in the Silicon Labs BT122 Bluetooth module allows unauthenticated adjacent attackers to leak potentially sensitive device memory by sending a malformed Bluetooth connection request. The root cause is a buffer over-read (CWE-126) in the firmware's connection request parser, identified as finding B-E4 in academic research published on arXiv (2409.02905). No public exploit code and no CISA KEV listing have been identified at time of analysis; risk is constrained by Bluetooth radio range and the niche embedded deployment footprint of the BT122.
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A command injection vulnerability exists in Silicon Labs Simplicity Studio V5 and Simplicity Installer Tool for Simplicity Studio V6, where vulnerable endpoints accept user-controlled input through URLs in JSON format, enabling arbitrary command execution. An attacker on the same network can exploit this to execute system commands, though parameter passing is restricted. While CVSS scoring is unavailable, the vulnerability represents a significant local network threat to development environments using these tools.