Vulnerabilities

Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.

In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network.

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution.

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution.

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition.

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop).

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash.

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption.

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with esc…

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory.

In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash.

An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917.

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service.

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution.

A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information.

Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value.

An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module.

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information.

The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service.

SMP security request (from peripheral) does not include the maximum encryption key size supported.

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier.

Bluetooth re-pairing with an existing device can use a lower security level.

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device.

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed.