TI-2026-79275 Aliases CVE-2026-66279 GHSA-x89v-v3m8-qmhg

Authentication bypass in Silicon Labs Connect Stack disrupts networks

LOW 31CWE-940Published 2026-10-22 · Updated 2026-10-23

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Silicon Labs Connect SDK from 4.0.0 through 4.3.1 and versions through 3.7.7 are affected. Improper verification of the source of a communication channel (CWE-940) may let a message with invalid security settings bypass authentication. An adjacent attacker with no privileges or user interaction can disrupt the network, but cannot obtain the Network Key or break confidentiality.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00245 15th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
silabs.com	Connect SDK	4.0.0 – 4.3.1; up to 3.7.7	—	No fix listed	CNA

Connect SDK Vendorsilabs.com Affected 4.0.0 – 4.3.1; up to 3.7.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Connect SDK.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-22 Threatist record created from CVE-2026-66279
2026-10-22 Alias added: GHSA-x89v-v3m8-qmhg
2026-10-23 CISA SSVC decision points changed
2026-10-23 Priority changed: MEDIUM → LOW

References

Patch 1

https://github.com/SiliconLabsSoftware/sisdk-release/

Advisory 1

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000588.md

TI-2023-24288 Heap-based buffer overflow in silabs.com Gecko Platform CVSS 3.1CRITICAL 10.0
TI-2023-14952 Memory corruption in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8
TI-2023-12925 Memory corruption in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8
TI-2023-12476 Heap-based buffer overflow in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8
TI-2022-08744 Heap-based buffer overflow in MicriumOS HTTP Server allows potential remote code execution CVSS 3.1CRITICAL 9.8
TI-2023-12937 Memory corruption in silabs.com Gecko Platform CVSS 3.1CRITICAL 9.8

See all 178 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences