CVEs published by Silicon Labs

CVEs published by Silicon Labs (CVE Numbering Authority). 17 tracked.

• CVE-2026-16101 HIGH 8.8 Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device
• CVE-2026-19291 HIGH 8.8 Bluetooth re-pairing with an existing device can use a lower security level
• CVE-2026-19292 HIGH 8.8 Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK
• CVE-2026-19293 HIGH 8.8 SMP security request (from peripheral) does not include the maximum encryption key size supported
• CVE-2026-65935 HIGH 7.6 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the tempo
• CVE-2026-65934 HIGH 7.1 An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module.  See vulnera
• CVE-2026-65932 MEDIUM 5.3 The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting
• CVE-2026-65933 MEDIUM 5.3 A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information
• CVE-2026-65936 MEDIUM 5.3 A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive i
• CVE-2026-94502 HIGH 7.5 In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write
• CVE-2026-89410 MEDIUM 5.1 In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensiti
• CVE-2026-85080 MEDIUM 6.0 In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write le
• CVE-2026-66282 MEDIUM 6.0 In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function
• CVE-2026-66281 MEDIUM 6.0 In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable
• CVE-2026-66279 HIGH 7.2 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may
• CVE-2026-89409 MEDIUM 5.3 In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices),
• CVE-2026-85079 HIGH 7.5 In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write pote

← Back to latest CVEs