Silicon Labs
Vulnerability activity for Silicon Labs: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 6
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 6
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.8CriticalOct 22, 2026Silicon Labs EmberZNet Memory corruptionCVE-2026-94502In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
- 5.1MediumOct 22, 2026Silicon Labs Z-Wave SDK Memory corruptionCVE-2026-89410In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.
- 9.1CriticalOct 22, 2026Silicon Labs EmberZNet Memory corruptionCVE-2026-85080In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.
- 7.5HighOct 22, 2026Silicon Labs EmberZNet Denial of serviceCVE-2026-66282In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
- 7.5HighOct 22, 2026Silicon Labs EmberZNet Denial of serviceCVE-2026-66281In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.
- 7.2HighOct 22, 2026Silicon Labs Connect SDKCVE-2026-66279In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.
Top products
- EmberZNet4 CVEs in the last year, 2 critical
- Z-Wave SDK1 CVE in the last year
- Connect SDK1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.