9.4
Critical
CVE-2025-8414 Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications
Description
Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is possible. In certain conditions, this could lead to arbitrary code execution. Access to a network key is required to exploit this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simplicity SDK 2025.6 | earliest → 2025.6.0 | No fix stated |
| Simplicity SDK 2024.12 | earliest → 2024.12.2 | No fix stated |
| Gecko SDK 4.4 | earliest → 4.4.6 | No fix stated |
Other CVEs of Simplicity SDK
The 8 CVEs of Simplicity SDK →
CVE-2026-4930
SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric…
7.1
High
CVE-2026-8676
An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the…
8.8
High
CVE-2025-14972
* Countermeasures for DPA within SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually…
4.1
Medium
CVE-2025-14547
An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs…
2.3
Low