Stack-based buffer overflow in silabs.com Gecko OS
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23245.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| silabs.com | Gecko OS | 1.0.46 | — | No fix listed | CNA |
- Gecko OS Vendorsilabs.com Affected 1.0.46 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:silabs:gecko_os:1.0.46:*:*:*:*:*:*:* | 1.0.46 | Vulnerable | silabs.com |
- cpe:2.3:o:silabs:gecko_os:1.0.46:*:*:*:*:*:*:* Versions 1.0.46 Vulnerable ·silabs.com
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2837
- 2026-10-03 Alias added: GHSA-c2w4-vpwj-jcm9
References
Advisory 2
More silabs.com Gecko Os vulnerabilities
- TI-2024-15920 Stack-based buffer overflow in silabs.com Gecko OS CVSS 3.1HIGH 8.8
- TI-2024-16256 Silicon Labs Gecko OS http_download Stack-based Buffer Overflow CVSS 3.1HIGH 8.8
- TI-2024-15948 Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow CVSS 3.1HIGH 8.8
- TI-2025-02478 Infinite loop in silabs.com Gecko OS CVSS 3.0MEDIUM 6.5
- TI-2024-15919 Silicon Labs Gecko OS Debug Interface Format String CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-2837 · CVE Program
- CVE-2025-2837 · NVD
- FIRST EPSS
- GHSA-c2w4-vpwj-jcm9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences