CVE-2026-6924

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.

CVSS

No CVSS.

References

Link	Resource
https://github.com/SiliconLabs/matter/tree/release_2.3.1-1.3
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/a45Vm0000009SzZIAU?operationContext=S1

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Un error en la inicialización de la entropía para SiWx917 provoca que el DRBG utilice una semilla predecible. Como tal, todos los números aleatorios generados en el código de Matter utilizan la misma secuencia de números. Esta vulnerabilidad fue descubierta después de que el repositorio afectado ya había sido desaprobado.

Information

Published : 2026-07-23 21:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-6924

Mitre link : CVE-2026-6924

CVE.ORG link : CVE-2026-6924

JSON object : View

Products Affected

No product.

CWE

CWE-336

Same Seed in Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2026-6924", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6924", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T13:40:22.863000Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "product-security@silabs.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-security@silabs.com", "affectedData": [{"repo": "https://github.com/SiliconLabs/simplicity_sdk", "vendor": "Silicon Labs", "product": "Silicon Labs Matter Github", "versions": [{"status": "affected", "version": "0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-23T21:17:05.447", "references": [{"url": "https://github.com/SiliconLabs/matter/tree/release_2.3.1-1.3", "source": "product-security@silabs.com"}, {"url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/a45Vm0000009SzZIAU?operationContext=S1", "source": "product-security@silabs.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "product-security@silabs.com", "description": [{"lang": "en", "value": "CWE-336"}]}], "descriptions": [{"lang": "en", "value": "A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated."}, {"lang": "es", "value": "Un error en la inicializaci\u00f3n de la entrop\u00eda para SiWx917 provoca que el DRBG utilice una semilla predecible. Como tal, todos los n\u00fameros aleatorios generados en el c\u00f3digo de Matter utilizan la misma secuencia de n\u00fameros. Esta vulnerabilidad fue descubierta despu\u00e9s de que el repositorio afectado ya hab\u00eda sido desaprobado."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "product-security@silabs.com"}