Medium severity · published Jun 6, 2024
CVE-2024-4013
Failure to update BT Mesh Replay Protection List
5.6
CVSS
0.3%
EPSS
No
On KEV
Description
A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection
List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the Gecko SDK was renamed to the Simplicity SDK, and the versioning scheme
was changed from Gecko SDK vX.Y.Z to Simplicity SDK YYYY.MM.Patch#.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
Gecko SDK · silabs.com
3.1.0 through 2024.06.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4013
community.silabs.com
https://community.silabs.com/068Vm000006rR53
github.com
https://github.com/SiliconLabs/gecko_sdk/releases
More from Gecko SDK
9.4
CVE-2025-8414
Zigbee Green Power Host Buffer Overflow Vulnerability
6.0
CVE-2025-12986
Denial of Service Vulnerability in Silicon Labs WF200 and WGM160P Devices
2.3
CVE-2025-14547
ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIs