The vulnerability lies in the DPA countermeasure within the SYMCRYPTO engine on SixG301xxx devices, where the randomization is insufficient and will eventually repeat. This flaw reduces the effectiveness of the countermeasure and can enable attackers to use Differential Power Analysis to recover secret keys, notably KSU keys that rely on SYMCRYPTO. The weakness corresponds to CWE‑331, representing insufficient entropy or randomness in cryptographic operations.

The affected assets are Silabs Simplicity SDK components running on SixG301xxx family devices. The flaw specifically impacts firmware that employs the SYMCRYPTO module for generating or protecting KSU keys. Version information was not disclosed in the advisory, so all current releases of the SDK that use SYMCRYPTO are potentially compromised.

The CVSS score of 4.1 indicates a low threat level, and there is no EPSS score available. The vulnerability is not listed in CISA KEV. The likely attack vector is offline, requiring an attacker to physically monitor power traces of the device over time to reconstruct the secret key. While the attack demands specialized equipment and time, the repeatable nature of the countermeasure weakness makes it feasible. No publicly disclosed exploits are currently known. Overall, the risk is moderate but tangible for environments where the device functionality is essential and key protection is paramount.