Silabs
96 CVEs across 61 Silabs products. Browse Silabs vulnerabilities, severities, and proof-of-concept exploits.
Silabs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4526 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These mess… |
CVE-2026-47154 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the proc… |
CVE-2026-47153 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a… |
CVE-2026-47152 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a… |
CVE-2026-47151 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location… |
CVE-2026-47150 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and… |
CVE-2026-47149 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These me… |
CVE-2026-47148 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process… |
CVE-2026-47147 | High | 7.1 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read bac… |
CVE-2026-47146 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that h… |
CVE-2026-47145 | Medium | 6.5 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that h… |
CVE-2025-12131 | Medium | 6.5 | 2026-02-05 | A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. |
CVE-2025-2838 | Medium | 6.5 | 2025-03-26 | Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a d… |
CVE-2025-2837 | High | 8.8 | 2025-03-26 | Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacke… |
CVE-2024-24731 | High | 7.5 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not requir… |
CVE-2024-23973 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not requir… |
CVE-2024-23937 | Medium | 4.3 | 2025-01-31 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is no… |
CVE-2024-50931 | Medium | 4.6 | 2024-12-10 | Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. |
CVE-2024-50930 | High | 8.8 | 2024-12-10 | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. |
CVE-2024-50929 | Medium | 6.2 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memor… |
CVE-2024-50928 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memo… |
CVE-2024-50924 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the… |
CVE-2024-50921 | Medium | 6.5 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending craft… |
CVE-2024-50920 | High | 8.8 | 2024-12-10 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. |
CVE-2024-23938 | High | 8.8 | 2024-09-28 | Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2023-41093 | Low | 3.1 | 2024-07-12 | Use After Free vulnerability in Silicon Labs Bluetooth SDK on 32 bit, ARM may allow an attacker with precise timing capabilities to intercept a small number of… |
CVE-2023-51394 | Medium | 5.3 | 2024-02-23 | High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash. |
CVE-2023-51393 | Medium | 5.3 | 2024-02-23 | Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (d… |
CVE-2023-51392 | Medium | 6.2 | 2024-02-23 | Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromag… |
CVE-2023-6640 | Medium | 6.5 | 2024-02-21 | Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier. |
CVE-2023-6533 | Medium | 6.5 | 2024-02-21 | Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After… |
CVE-2024-22473 | Medium | 6.8 | 2024-02-21 | TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing… |
CVE-2023-45318 | Critical | 10.0 | 2024-02-20 | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network p… |
CVE-2024-0240 | Medium | 6.5 | 2024-02-15 | A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this res… |
CVE-2023-6874 | High | 7.5 | 2024-02-05 | Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number |
CVE-2023-6387 | High | 7.5 | 2024-02-02 | A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execu… |
CVE-2023-5138 | Medium | 6.8 | 2024-01-03 | Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B. |
CVE-2023-4280 | Critical | 9.3 | 2024-01-02 | An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-4020 | Critical | 9.0 | 2023-12-15 | An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows r… |
CVE-2023-5310 | Medium | 5.7 | 2023-12-15 | A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier… |
CVE-2023-4489 | Medium | 6.4 | 2023-12-14 | The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This ma… |
CVE-2023-31247 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network… |
CVE-2023-28391 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets… |
CVE-2023-28379 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet… |
CVE-2023-27882 | Critical | 9.0 | 2023-11-14 | A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted netwo… |
CVE-2023-25181 | Critical | 9.0 | 2023-11-14 | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network pack… |
CVE-2023-24585 | High | 7.7 | 2023-11-14 | An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead t… |
CVE-2023-41096 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ex… |
CVE-2023-41095 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext… |
CVE-2023-3487 | High | 7.7 | 2023-10-20 | An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots. |
CVE-2020-27630 | Critical | 9.8 | 2023-10-10 | In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. |
CVE-2023-41094 | Critical | 10.0 | 2023-10-04 | TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifet… |
CVE-2023-3024 | Medium | 5.9 | 2023-09-29 | Forcing the Bluetooth LE stack to segment 'prepare write response' packets can lead to an out-of-bounds memory access. |
CVE-2023-4041 | Critical | 9.8 | 2023-08-23 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon… |
CVE-2023-3488 | Low | 3.8 | 2023-07-28 | Uninitialized buffer in GBL parser in Silicon Labs GSDK v4.3.0 and earlier allows attacker to leak data from Secure stack via malformed GBL file. |
CVE-2023-3110 | Critical | 9.6 | 2023-06-21 | Description: A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leadi… |
CVE-2023-0972 | Critical | 9.6 | 2023-06-21 | Description: A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, lead… |
CVE-2023-0971 | Critical | 9.6 | 2023-06-21 | A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encry… |
CVE-2023-0970 | High | 7.1 | 2023-06-21 | Multiple buffer overflow vulnerabilities in SiLabs Z/IP Gateway SDK version 7.18.01 and earlier allow an attacker with invasive physical access to a Z-Wave con… |
CVE-2023-0969 | Low | 3.5 | 2023-06-21 | A vulnerability in SiLabs Z/IP Gateway 7.18.01 and earlier allows an authenticated attacker within Z-Wave range to manipulate an array pointer to disclose the… |
CVE-2023-2747 | Low | 3.1 | 2023-06-15 | The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized. |
CVE-2023-2683 | Medium | 5.3 | 2023-06-15 | A memory leak in the EFR32 Bluetooth LE stack 5.1.0 through 5.1.1 allows an attacker to send an invalid pairing message and cause future legitimate connection… |
CVE-2023-2686 | Critical | 9.8 | 2023-06-15 | Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack. |
CVE-2023-2687 | Low | 2.9 | 2023-06-02 | Buffer overflow in Platform CLI component in Silicon Labs Gecko SDK v4.2.1 and earlier allows user to overwrite limited structures on the heap. |
CVE-2023-32100 | Medium | 5.3 | 2023-05-18 | Compiler removal of buffer clearing in sli_se_driver_mac_compute in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication… |
CVE-2023-32099 | Medium | 5.3 | 2023-05-18 | Compiler removal of buffer clearing in sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to R… |
CVE-2023-32098 | Medium | 5.3 | 2023-05-18 | Compiler removal of buffer clearing in sli_se_sign_message in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplicat… |
CVE-2023-32097 | Low | 3.1 | 2023-05-18 | Compiler removal of buffer clearing in sli_crypto_transparent_aead_decrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key… |
CVE-2023-32096 | Low | 3.1 | 2023-05-18 | Compiler removal of buffer clearing in sli_crypto_transparent_aead_encrypt_tag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key… |
CVE-2023-2481 | Medium | 5.3 | 2023-05-18 | Compiler removal of buffer clearing in sli_se_opaque_import_key in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplicati… |
CVE-2023-1132 | Medium | 5.3 | 2023-05-18 | Compiler removal of buffer clearing in sli_se_driver_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplicati… |
CVE-2023-0965 | Low | 3.1 | 2023-05-18 | Compiler removal of buffer clearing in sli_cryptoacc_transparent_key_agreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material d… |
CVE-2023-0775 | Medium | 6.5 | 2023-03-28 | An invalid ‘prepare write request’ command can cause the Bluetooth LE stack to run out of memory and fail to be able to handle subsequent connection requests… |
CVE-2023-1262 | High | 8.2 | 2023-03-21 | Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network. |
CVE-2023-1261 | High | 8.2 | 2023-03-21 | Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network. |
CVE-2022-24939 | Medium | 5.7 | 2022-11-18 | A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset… |
CVE-2022-24942 | Critical | 9.1 | 2022-11-15 | Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request. |
CVE-2022-24938 | Medium | 6.5 | 2022-11-14 | A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error. |
CVE-2022-24937 | Medium | 6.5 | 2022-11-14 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers. |
CVE-2022-24936 | High | 8.3 | 2022-11-02 | Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key… |
CVE-2022-24611 | Medium | 6.5 | 2022-05-17 | Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wa… |
CVE-2021-27411 | Medium | 6.5 | 2022-05-03 | Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverif… |
CVE-2018-25029 | High | 8.1 | 2022-02-04 | The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairi… |
CVE-2013-20003 | High | 8.3 | 2022-02-04 | Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker wit… |
CVE-2020-9061 | Medium | 6.5 | 2022-01-10 | Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon… |
CVE-2020-9060 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, Zo… |
CVE-2020-9059 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaus… |
CVE-2020-9058 | High | 8.1 | 2022-01-10 | Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome D… |
CVE-2020-9057 | High | 8.8 | 2022-01-10 | Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or… |
CVE-2020-10137 | Medium | 6.5 | 2022-01-10 | Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unaut… |
CVE-2021-31609 | Medium | 6.5 | 2021-09-07 | The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17… |
CVE-2020-13582 | High | 7.5 | 2021-01-26 | A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of se… |
CVE-2020-15532 | Medium | 6.5 | 2020-08-20 | Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air denial of service vulnerability in Bluetooth… |
CVE-2020-15531 | High | 8.8 | 2020-08-20 | Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air remote code execution vulnerability in Bluet… |
CVE-2018-19983 | Medium | 6.5 | 2018-12-09 | An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controlle… |