« Volver al listado

CVE-2025-2838

Estado: AnalizadaMedia (6.5)—

Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Silabs — Gecko OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-2838",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-2838",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-27T14:52:02.744978Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "zdi-disclosures@trendmicro.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "zdi-disclosures@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Silicon Labs",
          "product": "Gecko OS",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.46"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-03-26T22:15:15.803",
  "references": [
    {
      "url": "https://community.silabs.com/a45Vm0000000Atp",
      "tags": [
        "Permissions Required"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-872/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "zdi-disclosures@trendmicro.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "zdi-disclosures@trendmicro.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de denegación de servicio por bucle infinito en el procesamiento de respuestas DNS de Silicon Labs Gecko OS. Esta vulnerabilidad permite a atacantes adyacentes a la red crear una condición de denegación de servicio en las instalaciones afectadas de Silicon Labs Gecko OS. No se requiere autenticación para explotar esta vulnerabilidad. La falla específica se encuentra en el procesamiento de respuestas DNS. El problema se debe a un error lógico que puede generar un bucle infinito. Un atacante puede aprovechar esta vulnerabilidad para crear una condición de denegación de servicio en el sistema. Anteriormente, se denominaba ZDI-CAN-23392."
    }
  ],
  "lastModified": "2026-06-17T09:07:42.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:gecko_os:1.0.46:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5166FBAB-BD1A-4879-A14C-0C49A5604E1D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "zdi-disclosures@trendmicro.com"
}