CVE-2025-8414

Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.

CVSS

No CVSS.

References

Link	Resource
https://community.silabs.com/068Vm00000WJZED

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Debido a una validación de entrada incorrecta, una vulnerabilidad de desbordamiento de búfer está presente en las aplicaciones host Zigbee EZSP. Si el búfer se desborda, la corrupción de la pila es posible. En ciertas condiciones, esto podría llevar a la ejecución de código arbitrario. Se requiere acceso a una clave de red para explotar esta vulnerabilidad.

Information

Published : 2025-10-17 16:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-8414

Mitre link : CVE-2025-8414

CVE.ORG link : CVE-2025-8414

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-8414", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8414", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T17:19:58.824957Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "product-security@silabs.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-security@silabs.com", "affectedData": [{"repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "silabs.com", "product": "Simplicity SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.6.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2024.12.2"}], "packageName": "SiSDK", "defaultStatus": "unaffected"}, {"repo": "https://github.com/SiliconLabs/gsdk", "vendor": "silabs.com", "product": "Gecko SDK", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.4.6"}], "packageName": "GSDK", "defaultStatus": "unaffected"}]}], "published": "2025-10-17T16:15:39.413", "references": [{"url": "https://community.silabs.com/068Vm00000WJZED", "source": "product-security@silabs.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "product-security@silabs.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Due to improper input validation, a buffer overflow vulnerability is present in \n\nZigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain\n\nconditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability."}, {"lang": "es", "value": "Debido a una validaci\u00f3n de entrada incorrecta, una vulnerabilidad de desbordamiento de b\u00fafer est\u00e1 presente en las aplicaciones host Zigbee EZSP. Si el b\u00fafer se desborda, la corrupci\u00f3n de la pila es posible. En ciertas condiciones, esto podr\u00eda llevar a la ejecuci\u00f3n de c\u00f3digo arbitrario. Se requiere acceso a una clave de red para explotar esta vulnerabilidad."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "product-security@silabs.com"}