Silicon Labs
Monthly
Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.
Predictable cryptographic randomness in Silicon Labs' Matter implementation for the SiWx917 wireless SoC allows attackers to reconstruct DRBG output because an entropy-initialization bug seeds the deterministic random bit generator with a predictable value, so every device produces the same stream of 'random' numbers. Any keys, nonces, or session material derived from this generator in the affected Matter code are therefore guessable, undermining confidentiality of secured communications on affected devices. The issue was found only after the repository was deprecated; no public exploit identified at time of analysis and it is not in CISA KEV.
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash the target by sending a malformed Simple Metering GetProfileResponse message that triggers an out-of-bounds read while iterating interval entries, terminating the process. Exploitation requires the attacker to be an authenticated member of the Zigbee network and only affects devices implementing the Simple Metering cluster. No public exploit identified at time of analysis, and no information leakage back to the sender was observed.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigbee network to crash a target node by sending a malformed Level Control 'Step' command that triggers a divide-by-zero (CWE-369) fault and terminates the process. Only nodes implementing the Level Control cluster are affected, and exploitation requires the attacker to already be an authenticated member of the network (CVSS 4.0 PR:L, VA:H). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to crash the host process via a malformed Level Control 'Move' command that triggers a divide-by-zero fault. Only deployments where the target device supports the Level Control cluster are affected, and exploitation requires the attacker to be an authenticated member of the Zigbee network (PR:L). No public exploit identified at time of analysis; this is not on CISA KEV.
Out-of-bounds memory writes in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allow an already-joined network device to corrupt Door Lock schedule state by sending malformed ClearWeekdaySchedule messages. Only devices implementing the Door Lock cluster are affected, and the corruption is bounded in size and location, primarily threatening availability/integrity rather than data disclosure. No public exploit identified at time of analysis; a vendor patch is available.
Denial of service in Silicon Labs EmberZNet (Zigbee stack) versions 9.0.2 and earlier allows an already-joined network device to crash the host process by sending malformed IAS Zone enrollment messages, which trigger an out-of-bounds write to the state table. Only nodes that support the IAS Zone (security sensor) cluster are affected, and the attacker must already hold a valid place on the Zigbee network (PR:L). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash the target by sending Door Lock cluster messages containing malformed or out-of-range user identifiers, which trigger an out-of-bounds table read (CWE-125) that terminates the process. Only devices that implement the Door Lock cluster are affected, and no data is leaked back to the sender. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to crash a target by sending malformed GetGroupMembership commands, which cause repeated out-of-bounds reads past the message payload and terminate the process. Only devices implementing the Groups cluster are affected, and no information leakage to the sender was observed despite the read primitive. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is availability-only (process termination), not code execution or data disclosure.
Out-of-bounds read in the Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device send malformed Over-The-Air (OTA) update requests that drive the OTA Server cluster parser past buffer boundaries, leaking a small, size- and location-limited amount of RAM back to the requester and potentially disrupting the OTA service. Only nodes that implement the OTA Server cluster are affected, and exploitation requires prior network membership (PR:L authenticated). No public exploit is identified and the CVE is not in CISA KEV; the CVSS 4.0 base score of 7.1 is driven mainly by high availability impact (VA:H) rather than data theft.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash a target by sending malformed Color Control cluster messages that trip a reachable assertion and terminate the process. Only devices implementing the Color Control cluster (typically color-capable lighting) are affected, and the attacker must already be a member of the Zigbee network. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to crash the target by sending malformed Color Control cluster messages, which trigger a reachable assertion that terminates the process. Only devices implementing the Color Control cluster (typically Zigbee lighting/color-capable nodes and coordinators) are affected. Vendor-rated CVSS 4.0 7.1 with availability-only impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined Zigbee device to crash the process by sending malformed global ZCL (Zigbee Cluster Library) messages that trigger out-of-bounds reads in the framework parsing logic. The flaw affects availability only - no information leakage back to the sender was observed despite the dataset's 'Information Disclosure' tag. A vendor patch is available, and there is no public exploit identified at time of analysis.
Predictable cryptographic key generation in Silicon Labs EFR32xG27 wireless SoCs stems from incorrect use of the on-chip PUF (Physical Unclonable Function) when deriving user keys, allowing an adjacent attacker to anticipate or reconstruct keys that should be unique and secret. Affected firmware built with the Silicon Labs SiSDK loses the confidentiality and authentication guarantees of derived keys. No public exploit identified at time of analysis; the issue was self-reported by Silicon Labs and a vendor patch is available.
Hardware random number generator (HRNG) in Silicon Labs RS9116 SDK versions up to 2.13.1 produces predictable cryptographic values when the wireless module operates in power save mode, enabling adjacent attackers with user interaction to compromise encrypted communications and authentication mechanisms. Vendor patch available via GitHub; no active exploitation confirmed but cryptographic weakness poses high risk to WiFi/Bluetooth IoT deployments relying on the affected module's entropy source.
Kernel pool memory disclosure in Silicon Labs silabser.sys driver (v11.5.0 and earlier) allows a local attacker with physical device access to leak up to 145 bytes of uninitialized kernel pool memory by presenting a malicious USB device that sends malformed packets to the driver on Windows 10 and earlier. The CVSS 4.0 score of 2.4 reflects the narrow physical-access prerequisite (AV:P) and limited read-only confidentiality impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Kernel denial-of-service in Silicon Labs' silabser.sys Windows 8 driver for CP210x USB-to-UART bridge devices allows any local unprivileged user to trigger a kernel crash by supplying incorrect driver settings. The root cause is CWE-369 (Divide by Zero) inside a kernel-mode driver, meaning exploitation produces a Blue Screen of Death (BSOD) and full system reboot. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, ACK packets are dropped, causing the device networking stack to fail and rendering the IoT endpoint unresponsive. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV, but the patch is available from the vendor.
Improper bounds validation in Silicon Labs EmberZNet SDK versions 9.0.2 and earlier exposes Zigbee-connected devices to crashes and dynamic memory leakage via network-reachable input. Authenticated network attackers can trigger the flaw with low complexity, resulting in denial-of-service conditions or unintended disclosure of heap contents. No public exploit has been identified at time of analysis, and a vendor patch is available via the SISDK GitHub release repository.
Kernel pool memory corruption in Silicon Labs silabser.sys (the Windows kernel driver for CP210x USB-to-serial bridge devices) v11.5.0 and earlier allows a local unprivileged user who physically attaches a malicious CP210x-compatible USB device to escalate privileges to kernel-level code execution. The driver fails to validate USB device-supplied packet data before processing, enabling crafted malformed packets to corrupt Windows kernel pool allocations. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Remote code execution is possible in Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier through malformed Bluetooth extended advertisements that trigger out-of-bounds writes and stack corruption. The vulnerability is reachable only from devices already provisioned into the target mesh network, and only on provisioner nodes that have enabled extended advertisement support. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 base score of 8.9 reflects the high impact if exploitation conditions are met.
Predictable cryptographic randomness in Silicon Labs' Matter implementation for the SiWx917 wireless SoC allows attackers to reconstruct DRBG output because an entropy-initialization bug seeds the deterministic random bit generator with a predictable value, so every device produces the same stream of 'random' numbers. Any keys, nonces, or session material derived from this generator in the affected Matter code are therefore guessable, undermining confidentiality of secured communications on affected devices. The issue was found only after the repository was deprecated; no public exploit identified at time of analysis and it is not in CISA KEV.
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash the target by sending a malformed Simple Metering GetProfileResponse message that triggers an out-of-bounds read while iterating interval entries, terminating the process. Exploitation requires the attacker to be an authenticated member of the Zigbee network and only affects devices implementing the Simple Metering cluster. No public exploit identified at time of analysis, and no information leakage back to the sender was observed.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigbee network to crash a target node by sending a malformed Level Control 'Step' command that triggers a divide-by-zero (CWE-369) fault and terminates the process. Only nodes implementing the Level Control cluster are affected, and exploitation requires the attacker to already be an authenticated member of the network (CVSS 4.0 PR:L, VA:H). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to crash the host process via a malformed Level Control 'Move' command that triggers a divide-by-zero fault. Only deployments where the target device supports the Level Control cluster are affected, and exploitation requires the attacker to be an authenticated member of the Zigbee network (PR:L). No public exploit identified at time of analysis; this is not on CISA KEV.
Out-of-bounds memory writes in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allow an already-joined network device to corrupt Door Lock schedule state by sending malformed ClearWeekdaySchedule messages. Only devices implementing the Door Lock cluster are affected, and the corruption is bounded in size and location, primarily threatening availability/integrity rather than data disclosure. No public exploit identified at time of analysis; a vendor patch is available.
Denial of service in Silicon Labs EmberZNet (Zigbee stack) versions 9.0.2 and earlier allows an already-joined network device to crash the host process by sending malformed IAS Zone enrollment messages, which trigger an out-of-bounds write to the state table. Only nodes that support the IAS Zone (security sensor) cluster are affected, and the attacker must already hold a valid place on the Zigbee network (PR:L). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash the target by sending Door Lock cluster messages containing malformed or out-of-range user identifiers, which trigger an out-of-bounds table read (CWE-125) that terminates the process. Only devices that implement the Door Lock cluster are affected, and no data is leaked back to the sender. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to crash a target by sending malformed GetGroupMembership commands, which cause repeated out-of-bounds reads past the message payload and terminate the process. Only devices implementing the Groups cluster are affected, and no information leakage to the sender was observed despite the read primitive. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is availability-only (process termination), not code execution or data disclosure.
Out-of-bounds read in the Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device send malformed Over-The-Air (OTA) update requests that drive the OTA Server cluster parser past buffer boundaries, leaking a small, size- and location-limited amount of RAM back to the requester and potentially disrupting the OTA service. Only nodes that implement the OTA Server cluster are affected, and exploitation requires prior network membership (PR:L authenticated). No public exploit is identified and the CVE is not in CISA KEV; the CVSS 4.0 base score of 7.1 is driven mainly by high availability impact (VA:H) rather than data theft.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash a target by sending malformed Color Control cluster messages that trip a reachable assertion and terminate the process. Only devices implementing the Color Control cluster (typically color-capable lighting) are affected, and the attacker must already be a member of the Zigbee network. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to crash the target by sending malformed Color Control cluster messages, which trigger a reachable assertion that terminates the process. Only devices implementing the Color Control cluster (typically Zigbee lighting/color-capable nodes and coordinators) are affected. Vendor-rated CVSS 4.0 7.1 with availability-only impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined Zigbee device to crash the process by sending malformed global ZCL (Zigbee Cluster Library) messages that trigger out-of-bounds reads in the framework parsing logic. The flaw affects availability only - no information leakage back to the sender was observed despite the dataset's 'Information Disclosure' tag. A vendor patch is available, and there is no public exploit identified at time of analysis.
Predictable cryptographic key generation in Silicon Labs EFR32xG27 wireless SoCs stems from incorrect use of the on-chip PUF (Physical Unclonable Function) when deriving user keys, allowing an adjacent attacker to anticipate or reconstruct keys that should be unique and secret. Affected firmware built with the Silicon Labs SiSDK loses the confidentiality and authentication guarantees of derived keys. No public exploit identified at time of analysis; the issue was self-reported by Silicon Labs and a vendor patch is available.
Hardware random number generator (HRNG) in Silicon Labs RS9116 SDK versions up to 2.13.1 produces predictable cryptographic values when the wireless module operates in power save mode, enabling adjacent attackers with user interaction to compromise encrypted communications and authentication mechanisms. Vendor patch available via GitHub; no active exploitation confirmed but cryptographic weakness poses high risk to WiFi/Bluetooth IoT deployments relying on the affected module's entropy source.
Kernel pool memory disclosure in Silicon Labs silabser.sys driver (v11.5.0 and earlier) allows a local attacker with physical device access to leak up to 145 bytes of uninitialized kernel pool memory by presenting a malicious USB device that sends malformed packets to the driver on Windows 10 and earlier. The CVSS 4.0 score of 2.4 reflects the narrow physical-access prerequisite (AV:P) and limited read-only confidentiality impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Kernel denial-of-service in Silicon Labs' silabser.sys Windows 8 driver for CP210x USB-to-UART bridge devices allows any local unprivileged user to trigger a kernel crash by supplying incorrect driver settings. The root cause is CWE-369 (Divide by Zero) inside a kernel-mode driver, meaning exploitation produces a Blue Screen of Death (BSOD) and full system reboot. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running concurrent multiprotocol Zigbee and Thread. Under high network traffic loads, ACK packets are dropped, causing the device networking stack to fail and rendering the IoT endpoint unresponsive. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV, but the patch is available from the vendor.
Improper bounds validation in Silicon Labs EmberZNet SDK versions 9.0.2 and earlier exposes Zigbee-connected devices to crashes and dynamic memory leakage via network-reachable input. Authenticated network attackers can trigger the flaw with low complexity, resulting in denial-of-service conditions or unintended disclosure of heap contents. No public exploit has been identified at time of analysis, and a vendor patch is available via the SISDK GitHub release repository.