silabs.com vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917.High 7.1 · Sep 8, 2026
• CVE-2026-65935 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value.High 7.6 · Aug 13, 2026
• CVE-2026-65934 An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module.High 7.1 · Aug 13, 2026
• CVE-2026-19293 SMP security request (from peripheral) does not include the maximum encryption key size supported.High 8.8 · Aug 13, 2026
• CVE-2026-19292 Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier.High 8.8 · Aug 13, 2026
• CVE-2026-19291 Bluetooth re-pairing with an existing device can use a lower security level.High 8.8 · Aug 13, 2026
• CVE-2026-16101 Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device.High 8.8 · Aug 13, 2026
• CVE-2026-4930 SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryptiHigh 7.1 · Jun 25, 2026
• CVE-2026-8676 An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.High 8.8 · May 26, 2026
• CVE-2025-11004 The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints.High 7.5 · Feb 10, 2026
• CVE-2025-7964 After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee RouterCritical 9.2 · Jan 30, 2026
• CVE-2025-10285 The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crHigh 7.4 · Dec 4, 2025
• CVE-2025-4321 In a Bluetooth device, using RS9116-WiseConnect SDK experiences a Denial of Service, if it receives malformed L2CAP packets, only hard reset will bring the deviHigh 7.1 · Nov 17, 2025
• CVE-2025-10693 When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device.High 7.6 · Oct 31, 2025
• CVE-2025-8414 Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications.Critical 9.4 · Oct 17, 2025
• CVE-2025-7448 Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attackHigh 8.6 · Sep 12, 2025
• CVE-2024-9499 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary High 8.6 · Jan 24, 2025
• CVE-2024-9498 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code eHigh 8.6 · Jan 24, 2025
• CVE-2024-9497 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary codeHigh 8.6 · Jan 24, 2025
• CVE-2024-9496 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary coHigh 8.6 · Jan 24, 2025
• CVE-2024-9495 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary codHigh 8.6 · Jan 24, 2025
• CVE-2024-9494 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the  CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary coHigh 8.6 · Jan 24, 2025
• CVE-2024-9493 DLL hijacking vulnerabilities, caused by an uncontrolled search path in the  ToolStick installer can lead to privilege escalation and arbitrary code executioHigh 8.6 · Jan 24, 2025
• CVE-2024-9492 DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code High 8.6 · Jan 24, 2025
• CVE-2024-9491 DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code exeHigh 8.6 · Jan 24, 2025