# cve.now: Silicon Labs

The newest entries naming Silicon Labs as an affected vendor (up to 200), of 65 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107359](https://cve.now/CVE-2026-107359.md): Malformed Wi-Fi Beacon Causes Crash on WF200 (CVSS 7.1)
- [CVE-2026-89410](https://cve.now/CVE-2026-89410.md): Out-of-bounds read in Z-Wave NCP SPI Handler (CVSS 5.1)
- [CVE-2026-89409](https://cve.now/CVE-2026-89409.md): Unvalidated ZWAVE\_CMD\_NODES\_EXIST May Cause Deletion of End Nodes​ (CVSS 5.3)
- [CVE-2026-85079](https://cve.now/CVE-2026-85079.md): Out-of-bounds write in Zigbee Simple\_Desc\_req handling (CVSS 7.5)
- [CVE-2026-94502](https://cve.now/CVE-2026-94502.md): Out-of-bounds write in Zigbee Publish Price Matrix handling (CVSS 7.5)
- [CVE-2026-66282](https://cve.now/CVE-2026-66282.md): Authenticated Denial-of-Service in Zigbee Publish Billing Period (CVSS 6.0)
- [CVE-2026-66281](https://cve.now/CVE-2026-66281.md): Authenticated Denial-of-Service in Zigbee Discover Attributes Handling (CVSS 6.0)
- [CVE-2026-85080](https://cve.now/CVE-2026-85080.md): Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling (CVSS 6.0)
- [CVE-2026-66279](https://cve.now/CVE-2026-66279.md): Dis-connect vulnerability in Connect Stack (CVSS 7.2)
- [CVE-2026-15419](https://cve.now/CVE-2026-15419.md): CP210x Driver Memory Corruption results in Arbitrary Code Execution (CVSS 7.0)
- [CVE-2026-15418](https://cve.now/CVE-2026-15418.md): CP210x Memory Leakage (CVSS 2.4)
- [CVE-2026-15417](https://cve.now/CVE-2026-15417.md): CP210x Denial of Service (CVSS 6.9)
- [CVE-2026-17610](https://cve.now/CVE-2026-17610.md): RAIL 802.15.4 Mux missing ACK can lead to DoS (CVSS 6.0)
- [CVE-2026-5706](https://cve.now/CVE-2026-5706.md): Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements (CVSS 8.9)
- [CVE-2026-6924](https://cve.now/CVE-2026-6924.md): Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path (CVSS 8.7)
- [CVE-2026-6432](https://cve.now/CVE-2026-6432.md): Improper bounds validation in EmberZNet SDK (CVSS 5.3)
- [CVE-2026-47154](https://cve.now/CVE-2026-47154.md): Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47153](https://cve.now/CVE-2026-47153.md): Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47152](https://cve.now/CVE-2026-47152.md): Level Control Move divide-by-zero in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47151](https://cve.now/CVE-2026-47151.md): Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47150](https://cve.now/CVE-2026-47150.md): IAS Zone enroll invalid table index and write in EmberZNet 9.0.2 (CVSS 7.1)
- [CVE-2026-47149](https://cve.now/CVE-2026-47149.md): Door Lock GetUserType invalid table index in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47148](https://cve.now/CVE-2026-47148.md): Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47147](https://cve.now/CVE-2026-47147.md): OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47146](https://cve.now/CVE-2026-47146.md): Color Control color-temperature assertion abort in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-47145](https://cve.now/CVE-2026-47145.md): Color Control hue/saturation assertion abort in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-4526](https://cve.now/CVE-2026-4526.md): Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2 (CVSS 7.1)
- [CVE-2026-2815](https://cve.now/CVE-2026-2815.md): Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys (CVSS 8.4)
- [CVE-2026-3290](https://cve.now/CVE-2026-3290.md): Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values (CVSS 7.4)
- [CVE-2025-2838](https://cve.now/CVE-2025-2838.md): Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability (CVSS 6.5)
- [CVE-2025-2837](https://cve.now/CVE-2025-2837.md): Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2024-9055](https://cve.now/CVE-2024-9055.md): DPA Countermeasures need reseeding (CVSS 4.2)
- [CVE-2024-12975](https://cve.now/CVE-2024-12975.md): Silicon Labs CPC can leak information in full duplex SPI (CVSS 1.0)
- [CVE-2024-23937](https://cve.now/CVE-2024-23937.md): Silicon Labs Gecko OS Debug Interface Format String (CVSS 4.3)
- [CVE-2024-23973](https://cve.now/CVE-2024-23973.md): Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow (CVSS 8.8)
- [CVE-2024-24731](https://cve.now/CVE-2024-24731.md): Silicon Labs Gecko OS http\_download Stack-based Buffer Overflow (CVSS 7.5)
- [CVE-2024-23938](https://cve.now/CVE-2024-23938.md): Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8)
- [CVE-2023-41093](https://cve.now/CVE-2023-41093.md): Loss of confidentiality due to potential race condition in Bluetooth controller Connection\_Handle reuse (CVSS 3.1)
- [CVE-2024-22472](https://cve.now/CVE-2024-22472.md): Long S0 frames received by 500 series Z-Wave devices may cause buffer overflow (CVSS 8.1)
- [CVE-2023-51395](https://cve.now/CVE-2023-51395.md): Z-Wave S0 Decryption Vulnerability in End Devices (CVSS 8.8)
- [CVE-2023-39541](https://cve.now/CVE-2023-39541.md): A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. (CVSS 5.9)
- [CVE-2023-39540](https://cve.now/CVE-2023-39540.md): A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. (CVSS 5.9)
- [CVE-2023-45318](https://cve.now/CVE-2023-45318.md): A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. (CVSS 10.0)
- [CVE-2023-24585](https://cve.now/CVE-2023-24585.md): An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 7.7)
- [CVE-2023-25181](https://cve.now/CVE-2023-25181.md): A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0)
- [CVE-2023-28391](https://cve.now/CVE-2023-28391.md): A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0)
- [CVE-2023-27882](https://cve.now/CVE-2023-27882.md): A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0)
- [CVE-2023-28379](https://cve.now/CVE-2023-28379.md): A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0)
- [CVE-2023-31247](https://cve.now/CVE-2023-31247.md): A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0)
- [CVE-2023-41094](https://cve.now/CVE-2023-41094.md): Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet (CVSS 10.0)
- [CVE-2023-4041](https://cve.now/CVE-2023-4041.md): Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability (CVSS 9.8)
- [CVE-2023-3110](https://cve.now/CVE-2023-3110.md): Buffer overflow in S0 Decryption on Unify Gateway (CVSS 9.6)
- [CVE-2023-0972](https://cve.now/CVE-2023-0972.md): Buffer overflow in S0 Decryption on Z/IP Gatweay (CVSS 9.6)
- [CVE-2023-0971](https://cve.now/CVE-2023-0971.md): Command Authentication Bypass in Z/IP Gateway (CVSS 9.6)
- [CVE-2023-0970](https://cve.now/CVE-2023-0970.md): Serial API Buffer Overflow in Z/IP Gateway (CVSS 7.1)
- [CVE-2023-0969](https://cve.now/CVE-2023-0969.md): Global read overflow in Z/IP Gateway (CVSS 3.5)
- [CVE-2022-24937](https://cve.now/CVE-2022-24937.md): Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier (CVSS 6.5)
- [CVE-2018-25029](https://cve.now/CVE-2018-25029.md): The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio (no CVSS)
- [CVE-2013-20003](https://cve.now/CVE-2013-20003.md): Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allow (no CVSS)
- [CVE-2020-10137](https://cve.now/CVE-2020-10137.md): Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND\_NODE\_IN\_RANGE frames, allow (no CVSS)
- [CVE-2020-9061](https://cve.now/CVE-2020-9061.md): Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 (no CVSS)
- [CVE-2020-9060](https://cve.now/CVE-2020-9060.md): Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN (no CVSS)
- [CVE-2020-9059](https://cve.now/CVE-2020-9059.md): Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leadin (no CVSS)
- [CVE-2020-9058](https://cve.now/CVE-2020-9058.md): Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 (no CVSS)
- [CVE-2020-9057](https://cve.now/CVE-2020-9057.md): Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/silicon-labs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.