CVE-2023-5310 Z-Wave Denial of Service caused by Stream of Packets

Medium 5.7 Published 15 Dec 2023 Updated 8 Oct 2024

Attackers on the network can cause denial of service in Silicon Labs Z-Wave devices by sending a stream of packets.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-5310?

CVE-2023-5310 is a medium-severity denial of service vulnerability in silabs.com Gecko SDK, published on 15 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A denial of service vulnerability exists in all Silicon Labs Z-Wave controller and endpoint devices running Z-Wave SDK v7.20.3 (Gecko SDK v4.3.3) and earlier. This attack can be carried out only by devices on the network sending a stream of packets to the device.

Weakness: CWE-248

Which versions are affected by CVE-2023-5310?

It affects 1 product.

Products include Silabs Z-Wave Software Development Kit.

How do I fix CVE-2023-5310?

No fix has been published for CVE-2023-5310 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-5310 being exploited?

There is no known exploitation of CVE-2023-5310 in the wild and no public exploit code.

Sources

Also known as GHSA-c948-477j-77c3.