Vendor
silabs.com
99 known vulnerabilities.
Products
35 results · Clear filters · Feed
-
High 7.1
RS9116W/SiWx917 plaintext pause encryption request causes DOS
An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below.
-
High 7.6
Bypassing passkey entry in legacy pairing
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.
-
High 7.1
BT122 plaintext pause encryption request causes DOS
An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.
-
High 8.8
SMP security request
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
-
High 8.8
Bluetooth re-pairing with legitimate device can use lower security level
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
-
High 8.8
Bluetooth re-pairing can use a lower security level than previous
Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.
-
High 8.8
forced re-pairing with already bonded device
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
-
High 7.1
DPA Countermeasures weakening on Series 3 devices
SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing). DPA Countermeasures on SYMCRYPTO can be weakened (reduced entropy) by forcing cert…
-
High 8.8
An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the b…
-
High 7.5
Reflected XSS vulnerability in Simplicity Device Manager tool
The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of th…
-
High 7.4
Simplcity Device Manager exposes NTLMv2 hash
The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
-
High 7.1CVE-2025-4321 Public exploit
DoS in RS9116W-WiSeConnect L2CAP protocol due to reception of malformed packets
In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation
-
High 7.6
Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure
When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0 and v2025…
-
High 8.6
Man in the middle (MitM) attack vulnerability in Wi-SUN library
Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in USBXpress Win 98SE Dev Kit installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in USBXpress SDK installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in USBXpress 4 SDK installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in USBXpress Dev Kit installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in CP210x VCP Windows installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in CP210 VCP Win 2k installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in ToolStick installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in Flash Programming Utility installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 7.5
DoS caused due to wrong hash length returned for SHA2/224 algorithm
In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart after w…
-
High 7.5
Zigbee co-ordinator realignment packet may lead to denial of service
An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY qual…
-
High 7.5
Z/IP Gateway S2 Nonce Get Denial of Service Vulnerability
Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway.
-
High 7.5
Z/IP Gateway Device Reset Locally Denial of Service Vulnerability
Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.
-
High 7.5
Micrium OS Network uC-HTTP server header parsing invalid pointer dereference vulnerability
A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Service.
-
High 7.5
Zigbee Unauthenticated DoS via NWK Sequence number manipulation
Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number
-
High 7.5CVE-2023-6387 Public exploit
Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow
A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution
-
High 7.7
Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access
An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.
-
High 8.2
Missing MAC layer security in Wi-SUN Linux Border Router
Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network.
-
High 8.2
Missing MAC layer security in Wi-SUN SDK
Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.
-
High 8.3
Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices
Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade.