Design/Logic Flaw

Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 delivered as part of Silicon Labs Gecko SDK v4.4.0 which may enable attackers to trigger a bus fault and crash of the device, requiring a...

CVE-2023-51393 Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer

Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 delivered as part of Silicon Labs Gecko SDK v4.4.0 which may enable attackers to trigger a bus fault and crash of the device, requiring a...

CVE-2023-51393

CVE-2023-51393 affects Silicon Labs Ember ZNet SDK prior to v7.4.0.0 (delivered with Gecko SDK v4.4.0). The root cause is an allocation of resources without limits, causing uncontrolled resource consumption that can trigger a bus fault and crash the device, requiring a reboot to rejoin the networ...

CVE-2023-51393 Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer

Due to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 delivered as part of Silicon Labs Gecko SDK v4.4.0 which may enable attackers to trigger a bus fault and crash of the device, requiring a...

CVE-2023-51394

CVE-2023-51394 affects Silicon Labs Ember ZNet SDK prior to v7.4.0. In high-traffic environments, a NULL pointer dereference can cause a system crash. The issue, per the CVE records, is tied to Ember ZNet SDK versions before 7.4.0, with a remediation path to update to 7.4.0 or later. Public docum...

CVE-2023-51394 Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash

High traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash...

CVE-2023-51392 Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM

Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks...

CVE-2023-51392 Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM

Ember ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of electromagnetic and differential power analysis sidechannel attacks...

Earth Preta’s DOPLUGS Leaves its Mark in Asia

Summary: The Chinese threat actor, Earth Preta, strategically targeted numerous Asian countries by employing a customized version of the PlugX backdoor known as DOPLUGS. This sophisticated threat was allegedly revealed during the SMUGX campaign in July 2023. Threat Level - Red | Attack Report For...

Silicon Labs Ember ZNet Code Issue Vulnerability

Silicon Labs Ember ZNet is a protocol stack software from Silicon Labs, Inc. A code issue vulnerability exists in Silicon Labs Ember ZNet SDK prior to version v7.4.0 that stems from the presence of a NULL pointer dereference, which may cause a system crash...

Silicon Labs Gecko SDK Security Vulnerability

The Silicon Labs Gecko SDK GSDK is an open source library from Silicon Labs. Combines the Silicon Labs Wireless Software Development Kit SDK and the Gecko platform into one integrated package. A security vulnerability exists in Silicon Labs Ember ZNet SDK prior to v7.4.0.0 that stems from an...

UOB, Samsung Back Singapore’s Startale Labs in $7 Million Web3 Push

By Owais Sultan Startale Labs, the developer behind Japans leading Web3 products like Astar Network and Startale Web3 Cloud, has secured… This is a post from HackRead.com Read the original post: UOB, Samsung Back Singapores Startale Labs in $7 Million Web3 Push...

CVE-2023-6640 Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability

Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier...

CVE-2023-6640 Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability

Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier...

CVE-2023-6533 Silicon Labs PC Controller Denial of Service Vulnerability

Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end device has left the network. After this, frames sent by the end device will not be acknowledged by the controller. This vulnerability exists in PC Controller v5.54.0, and...

Kimsuky Exploits Legitimate Certificate to Disseminate TrollAgent

Summary: The Kimsuky group, backed by North Korea, used TrollAgent malware via a fake security program to target a Korean construction associations website, stealing data and enabling remote control between December 2023 and January 2024. Threat Level - Amber | Attack Report For a detailed threat...

Iranian Threat Actor Adapts Tactics to Stay One Step Ahead

Summary: Charming Kitten, an Iranian threat actor, has recently been linked to a series of attacks targeting the Middle East. This campaign involves deploying a new backdoor called BASICSTAR through a deceptive webinar portal. Threat Level - Red | Attack Report For a detailed threat advisory,...

Silicon Labs PC Controller Security Vulnerability

Silicon Labs PC Controller is an installation and maintenance tool for Z-Wave networks from Silicon Labs that allows developers to manage Z-Wave devices on a PC for network configuration, troubleshooting, and monitoring. A security vulnerability exists in Silicon Labs PC Controller v5.54.0 and...

Silicon Labs PC Controller Security Vulnerability

Silicon Labs PC Controller is an installation and maintenance tool for Z-Wave networks from Silicon Labs that allows developers to manage Z-Wave devices on a PC for network configuration, troubleshooting, and monitoring. A security vulnerability exists in Silicon Labs PC Controller v5.54.0 and...

Akira Ransomware Exploits Cisco Flaw for Maximum Impact

Summary: The Akira ransomware has been identified for utilizing the Cisco AnyConnect SSL VPN as its initial access vector, specifically exploiting the CVE-2020-3259 vulnerability. Despite Cisco addressing this vulnerability with patches released in May 2020, the threat remains prevalent. Threat...