CVE-2024-3017: Denial of service in multi-protocol gateway - Zigbee + Thread

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-27 · updated 2026-06-17
Weakness: CWE-125

Description

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (RCP) causes the OpenThread Border Router(OTBR) application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service.

Affected products

silabs.com SiSDK: before 2024.06.0 — fixed in 2024.06.0

How to fix

Upgrade to a fixed version: silabs.com SiSDK 2024.06.0. Check the vendor advisory for mitigations.

References

https://community.silabs.com/069Vm000007UEhZIAW
https://github.com/SiliconLabs/simplicity_sdk
https://community.silabs.com/069Vm000007UEhZIAW
https://github.com/SiliconLabs/simplicity_sdk

Get alerted when CVE-2024-3017 or the next vulnerability affects your stack