What’s Vulnerable › Vulnerabilities

CVE-2023-2747: Uninitialized IV in Silicon Labs SE FW v2.0.0 through v 2.2.1 for internally stored data

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-15 · updated 2026-06-17
• Weakness: CWE-1204

Description

The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.

Affected products

• silabs.com Gecko Platform: from 2.0.0 before 2.2.1 — fixed in 2.2.1

How to fix

Upgrade to a fixed version: silabs.com Gecko Platform 2.2.1. Check the vendor advisory for mitigations.

References

• https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sFvQAJ?operationContext=S1
• https://github.com/SiliconLabs/gecko_sdk
• https://community.silabs.com/sfc/servlet.shepherd/document/download/0698Y00000U2sFvQAJ?operationContext=S1
• https://github.com/SiliconLabs/gecko_sdk

Get alerted when CVE-2023-2747 or the next vulnerability affects your stack