Vendor
silabs.com
99 known vulnerabilities.
Products
99 results · Feed
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in ToolStick installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in Flash Programming Utility installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
-
Medium 5.8
Dos in ZigBee device due to unsolicited encrypted rejoin response
A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established
-
Medium 4.3
Malformed packet leads to denial of service in APS layer
A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert
-
Low 3.7
Ember ZNet buffer overflow in 'packet handoff' plugin
A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer.
-
Medium 6.5
EmberZNet malformed MAC layer packet leads to denial of service
A malformed 802.15.4 packet causes a buffer overflow to occur leading to an assert and a denial of service. A watchdog reset clears the error condition automatically.
-
High 7.5
DoS caused due to wrong hash length returned for SHA2/224 algorithm
In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart after w…
-
Medium 6.5
Denial of Service in Silicon Labs RS9116 Bluetooth SDK
Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover …
-
Medium 6.5
Denial of Service in Silicon Labs RS9116 Bluetooth SDK
An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device.
-
Medium 6.5
Denial of Service in Silicon Labs RS9116 Bluetooth SDK
The L2CAP receive data buffer for L2CAP packets is restricted to packet sizes smaller than the maximum supported packet size. Receiving a packet that exceeds the restricted buffer length may cause a crash. A hard reset is required to recover the crashed devic…
-
Medium 6.5
BLE peripheral DoS after few cycles of connect/disconnects
A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and disconnect to the peripheral. A hard reset is required to recover the peripheral device.
-
Low 2.0
Failure to update the tamper reset cause register when a tamper event occurs
An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. This is possible because the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event (a tamper reset…
-
Medium 6.5
Denial of service in multi-protocol gateway - Zigbee + Thread
In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (RCP) causes the OpenThread Border Router(OTBR) application task running on the host platform to crash, allowing an attacker to cause a tempor…
-
High 7.5
Zigbee co-ordinator realignment packet may lead to denial of service
An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY qual…
-
Medium 5.6
Failure to update BT Mesh Replay Protection List
A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the Gecko SDK was rename…
-
High 7.5
Z/IP Gateway S2 Nonce Get Denial of Service Vulnerability
Malformed S2 Nonce Get command classes can be sent to crash the gateway. A hard reset is required to recover the gateway.
-
High 7.5
Z/IP Gateway Device Reset Locally Denial of Service Vulnerability
Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.
-
High 7.5
Micrium OS Network uC-HTTP server header parsing invalid pointer dereference vulnerability
A bug in Micrium OS Network HTTP Server permits an invalid pointer dereference during header processing - potentially allowing a device crash and Denial of Service.
-
Medium 5.3
Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer
Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault…
-
Medium 5.3
Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash
High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.
-
Medium 6.2
Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM
Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.
-
Medium 6.5
Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability
Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier.
-
Medium 6.5
Silicon Labs PC Controller Denial of Service Vulnerability
Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability …
-
Medium 6.8
Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
-
Medium 6.5
Silicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clients
A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop.
-
High 7.5
Zigbee Unauthenticated DoS via NWK Sequence number manipulation
Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number
-
High 7.5CVE-2023-6387 Public exploit
Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow
A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution
-
Medium 6.8
Glitch detection not active by default in Silicon Labs Secure Vault High devices
Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.
-
Critical 9.3
Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory region
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
-
Medium 4.6
Potential Timing vulnerability in CBC PKCS7 padding calculations
An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.
-
Critical 9.0
Unvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory
An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory.
-
Medium 5.7
Z-Wave Denial of Service caused by Stream of Packets
A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier. This attack can be carried out only by devices on the network sending a stream of packets to the dev…
-
Medium 6.4
Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key
The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction a…
-
Medium 6.8
Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devices
Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs Ember ZNet SDK: 7.3.…
-
Medium 6.8
Keys Stored in Plaintext on Secure Vault High for Silabs OpenThread devices
Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.…
-
High 7.7
Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access
An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.
-
Medium 5.9
Bluetooth LE segmented 'prepare write response' packet may lead to out-of-bounds memory access
Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access.
-
Low 3.8
Uninitialized variable in Gecko Bootloader can leak secure stack
Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file.