CVE-2025-2838: (Pwn2Own) Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability
First published: Wed Mar 26 2025(Updated: )
Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SiLabs Gecko SDK |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2838?
CVE-2025-2838 is classified as a denial-of-service vulnerability that can impact system availability.
How do I fix CVE-2025-2838?
To mitigate CVE-2025-2838, it is recommended to apply the latest security patches provided by Silicon Labs for Gecko OS.
Who is affected by CVE-2025-2838?
CVE-2025-2838 affects installations of Silicon Labs Gecko OS that are exposed to network-adjacent attackers.
Can CVE-2025-2838 be exploited remotely?
Yes, CVE-2025-2838 can be exploited by network-adjacent attackers without the need for authentication.
What is the impact of CVE-2025-2838?
The impact of CVE-2025-2838 is a denial-of-service condition, which can render affected systems unresponsive.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-872
- alias/ZDI-CAN-23392
- alias/CVE-2025-2838
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/silicon labs
- canonical/silabs gecko sdk