Filtered by vendor Silabs
Subscribe
Total
101 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-66281 | 1 Silabs | 1 Emberznet | 2026-10-29 | N/A | 7.5 HIGH |
| In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted. | |||||
| CVE-2026-66282 | 1 Silabs | 1 Emberznet | 2026-10-29 | N/A | 7.5 HIGH |
| In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted. | |||||
| CVE-2026-85079 | 1 Silabs | 1 Emberznet | 2026-10-29 | N/A | 9.8 CRITICAL |
| In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed. | |||||
| CVE-2026-85080 | 1 Silabs | 1 Emberznet | 2026-10-29 | N/A | 9.1 CRITICAL |
| In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted. | |||||
| CVE-2026-94502 | 1 Silabs | 1 Emberznet | 2026-10-29 | N/A | 9.8 CRITICAL |
| In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted. | |||||
| CVE-2026-4526 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. | |||||
| CVE-2026-47148 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted. | |||||
| CVE-2026-47153 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | |||||
| CVE-2026-47151 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 7.1 HIGH |
| In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted. | |||||
| CVE-2026-47147 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 7.1 HIGH |
| In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted. | |||||
| CVE-2026-47154 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted. | |||||
| CVE-2026-47149 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted. | |||||
| CVE-2026-47152 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | |||||
| CVE-2026-47145 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | |||||
| CVE-2026-47146 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 6.5 MEDIUM |
| In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | |||||
| CVE-2026-47150 | 1 Silabs | 1 Emberznet | 2026-10-25 | N/A | 7.1 HIGH |
| In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted. | |||||
| CVE-2025-12131 | 1 Silabs | 1 Simplicity Software Development Kit | 2026-08-20 | N/A | 6.5 MEDIUM |
| A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. | |||||
| CVE-2022-24611 | 1 Silabs | 10 Sd3502, Sd3502 Firmware, Sd3503 and 7 more | 2026-07-09 | 6.1 MEDIUM | 6.5 MEDIUM |
| Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs. | |||||
| CVE-2025-2838 | 1 Silabs | 1 Gecko Os | 2026-06-17 | N/A | 6.5 MEDIUM |
| Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392. | |||||
| CVE-2025-2837 | 1 Silabs | 1 Gecko Os | 2026-06-17 | N/A | 8.8 HIGH |
| Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23245. | |||||