Silabs.com vulnerabilities
We track 46 vulnerabilities in Silabs.com products across 26 products. 46 are rated high or critical, and none are known to be exploited. The most recent was published on September 8, 2026.
Latest Silabs.com vulnerabilities
- 7.1 High severity
WiseCnnect: Expected Behavior Violation
An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the related paper below.
- 7.6 High severity
WiseConnect: Authentication Bypass by Primary Weakness
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.
- 8.8 High severity
WiseConnect: Weak Password Requirements
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
- 8.8 High severity
WiseConnect: Authentication Bypass by Primary Weakness
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
- 7.1 High severity
Simplicity SDK: Insufficient Entropy
SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing). DPA Countermeasures on SYMCRYPTO can be weakened (reduced entropy) by forcing certa
- 8.8 High severity
Simplicity SDK: Authentication Bypass by Spoofing
An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.
- 7.5 High severity
Simplicity Device Manager: Improper Neutralization of Input During Web Page Generation
The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the
- 9.2 Critical severity
Silicon Labs Zigbee Stack: Improper Handling of Values
After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices will be
- 7.4 High severity
Simplicity Studio V6: Exposure of Sensitive Information to an Unauthorized Actor
The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
- 7.1 High severity
RS9116W: Improper Handling of Inconsistent Structural Elements
In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the device to normal operation
- 7.6 High severity
Silicon Labs Z-Wave SDK: Selection of Less-Secure Algorithm During Negotiation
When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device. This vulnerability exists in Silicon Labs' Z-Wave PIR Sensor Reference design delivered as part of SiSDK v2025.6.0 and v2025.
- 9.4 Critical severity
Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP…
Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is
- 8.6 High severity
USBXpress Win 98SE Dev Kit: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
USBXpress SDK: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
USBXpress 4 SDK: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
USBXpress Dev Kit: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
CP210x VCP Windows: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
CP210 VCP Win 2k: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
ToolStick: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
Flash Programming Utility: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
Configuration Wizard 2: Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 8.6 High severity
Silicon Labs IDE (8-bit): Uncontrolled Search Path Element
DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- 7.5 High severity
WiSeConnect SDK: Incorrect Calculation of Buffer Size
In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart after wa
- 7.5 High severity
Ember ZNet SDK: Inclusion of Functionality from Untrusted Control Sphere
An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY quali
- 7.5 High severity
Z/IP Gateway SDK: Uncaught Exception
Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent by the end device will not be acknowledged by the gateway during this time.
- 7.5 High severity
Ember ZNet SDK: NULL Pointer Dereference
High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.
- 7.5 High severity
Ember ZNet SDK: Allocation of Resources Without Limits or Throttling
Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault
- 9.8 Critical severity
Ember ZNet SDK: Use of a Broken or Risky Cryptographic Algorithm
Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks.
- 7.5 High severity
GSDK: Insufficient Entropy
TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE) devices. This defect may allow Signature Spoofing by Key Recreation.This issue affects Gecko SDK through v4.4.0.
- 7.5 High severity
GSDK: Incorrect Calculation of Buffer Size
A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service or remote code execution
- 9.8 Critical severity
GSDK: Out-of-bounds Read
An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an attacker to access the trusted region of memory from the untrusted region.
- 7.5 High severity
GSDK: Observable Discrepancy
An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.
- 9.1 Critical severity
GSDK: Out-of-bounds Read
An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory.
- 9.8 Critical severity
Z/IP Gateway SDK: Use of Uninitialized Resource
The first S0 encryption key is generated with an uninitialized PRNG in Z/IP Gateway products running Silicon Labs Z/IP Gateway SDK v7.18.3 and earlier. This makes the first S0 key generated at startup predictable, potentially allowing network key prediction an
- 9.1 Critical severity
OpenThread SDK: Missing Encryption of Sensitive Data
Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or extraction of network credentials stored in flash. This issue affects Silicon Labs OpenThread SDK: 2.3.1
- 7.8 High severity
GSDK: Integer Overflow or Wraparound
An integer overflow in Silicon Labs Gecko Bootloader version 4.3.1 and earlier allows unbounded memory access when reading from or writing to storage slots.
- 9.8 Critical severity
Gecko Platform: Buffer Copy without Checking Size of Input
Buffer overflow in Wi-Fi Commissioning MicriumOS example in Silicon Labs Gecko SDK v4.2.3 or earlier allows connected device to write payload onto the stack.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_driver_mac_compute in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_sign_hash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.
- 7.5 High severity
Gecko Platform: Compiler Removal of Code to Clear Buffers
Compiler removal of buffer clearing in sli_se_sign_message in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM.