Vulnerability in Silicon Labs Connect Sdk

CVE-2026-66279

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

Published 2026-10-22 · last modified 2026-10-22.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Silicon Labs Connect Sdk

Weakness classification (CWE)

CWE-940 — Improper Verification of Source of a Communication Channel

References

github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/50… (vendor-advisory, permissions-required)
github.com/SiliconLabsSoftware/sisdk-release/ (patch)