CVE-2023-51395 — The vulnerability described by CVE-2023-0972 has been additionally discovered in

The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.

01What is this vulnerability?

The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.

02Affected products

Vendor	Product	Versions
Silicon Labs	Z	Wave SDK — 7.20.0, 7.19.3, 7.18.8, 7.17.5

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2024-03-07T04:50:54.651Z
• Last modified: 2024-09-25T16:03:46.409Z

09References

• community.silabs.com — https://community.silabs.com/068Vm0000029Xq5