Silabs.com Simplicity SDK vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Silabs.com Simplicity SDK: 6 record(s), with affected versions and fixes.

CVE-2026-4930 High · 7.1 CWE-331 Jun 25, 2026

DPA Countermeasures weakening on Series 3 devices

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing). DPA Countermeasures on SYMCRYPTO can be weakened (reduced entropy) by forcing certain seed values if an attacker gains code execution capability on the impacted device. * Therefore, the keys loaded on SYMCRYPTO may be more vulnerable to extraction through DPA attacks than intended

CVE-2026-8676 High · 8.8 CWE-290 May 26, 2026

Authentication Bypass by Spoofing in Silabs.com Simplicity SDK

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.

CVE-2025-14972 Medium · 4.1 CWE-331 May 15, 2026

Insufficient DPA countermeasure reseeding

* Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. * KSU keys using SYMCRYPTO will be impacted by this vulnerability.

CVE-2025-14547 Low · 2.3 CWE-191 Feb 20, 2026

ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIs

An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service.

CVE-2025-7432 Low · 1.0 CWE-331 Feb 9, 2026

DPA countermeasures not reseeded under certain conditions

DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys through a DPA attack.

CVE-2025-8414 Critical · 9.4 CWE-20 Oct 17, 2025

Silicon Labs Zigbee EZSP Host Applications Buffer Overflow

Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.