CVE-2025-8414: Silicon Labs Zigbee EZSP Host Applications Buffer Overflow
Zigbee EZSP host applications from Silicon Labs contain a buffer overflow caused by improper input validation, which can corrupt the stack. The record states that code execution is possible under certain conditions and that access to a network key is required. The CVSS 4.0 score in the record is 9.4, and the CVE is not listed in CISA KEV.
Overview
The record describes CVE-2025-8414, a buffer overflow in Zigbee EZSP Host Applications caused by improper input validation. The CNA contact is product-security@silabs.com, which indicates Silicon Labs as the vendor (inference). The record classifies the weakness as CWE-20 (Improper Input Validation) and links to a Silicon Labs community post.
Impact
- If the buffer overflows, stack corruption is possible.
- The record states that, in certain conditions, this could lead to arbitrary code execution.
- The record states that access to a network key is required to exploit the vulnerability.
- The CVSS 4.0 base score in the record is 9.4 (critical), with the vector CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.
The high impact ratings reflect the record's scoring. The specific conditions that enable code execution are not described in the available data.
Affected products and versions
The record does not list affected products, versions or platforms. It names only the component Zigbee EZSP Host Applications. Consult the vendor advisory for the exact list of affected releases.
Exploitation status
The CVE is not listed in the CISA KEV catalog in this record. No confirmed exploitation appears in the sources consulted. The EPSS data in the record (probability 0.00274, percentile 0.1831) estimates likelihood and does not confirm exploitation.
Remediation and mitigation
- Review the vendor community post for guidance on updated host applications. The record contains no fixed version, so the remediation status is unknown from the record.
- Inventory Zigbee deployments that use EZSP host applications and record their component versions.
- Restrict who has access to network keys and limit the ability to join the Zigbee network, which addresses the prerequisite described in the record.
- Apply network segmentation and defense-in-depth controls to gateways running these host applications.
Detection guidance
- Monitor host applications for unexpected crashes, restarts or instability, which can indicate memory corruption.
- Review gateway logs for unusual Zigbee network activity and unexpected devices joining the network.
- Track changes to network credentials and alert on unexpected key rotation or use.
Limitations of available information
The record has no affected or fixed version data, no affected platform list, and no title. The source status is Deferred. The description does not identify the conditions required for code execution or which EZSP host implementations are affected. The vendor page content was not included in the record, so its details could not be verified.
Frequently asked questions
What is CVE-2025-8414?
It is a buffer overflow in Zigbee EZSP Host Applications caused by improper input validation. The record says it can corrupt the stack and, in certain conditions, lead to arbitrary code execution.
Does the record say what access is needed to exploit it?
Yes. The record states that access to a network key is required to exploit this vulnerability.
Is this CVE known to be actively exploited?
No. The CVE is not listed in CISA KEV in this record, and no confirmed exploitation appears in the sources consulted.
Which versions are fixed?
The record does not list fixed versions. Check the vendor community post linked in the analysis for remediation details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.