High severity · published Feb 23, 2024
CVE-2023-51393
Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered as part of Silicon Labs Gecko SDK v4.4.0) which may enable attackers to trigger a bus fault and crash of the device, requiring a reboot in order to rejoin the network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EZ
Ember ZNet SDK · silabs.com
All versions, or not specified · source: vendor
EM
Emberznet · Silabs
before 7.4.0 · source: NVD
ES
Emberznet Sdk · Silabs
before 7.4.0.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-51393
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-51393
Permissions Required
https://community.silabs.com/068Vm000001NaAM
More from Ember ZNet SDK
9.8
CVE-2023-51392
Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM
7.5
CVE-2024-3043
Zigbee co-ordinator realignment packet may lead to denial of service
7.5
CVE-2023-51394
Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash
3.7
CVE-2024-10106
Ember ZNet buffer overflow in 'packet handoff' plugin