An incorrect usage of the Physical Unclonable Function (PUF) key during user key generation in the EFR32xG27 platform results in keys that can be predicted by an attacker. This flaw directly compromises the confidentiality of stored cryptographic keys and is classified under CWE‑339, indicating a reliance on an insufficiently random source for key generation.

The vulnerability affects devices running Silicon Labs SiSDK for the EFR32xG27 series. Specific affected firmware or SDK version numbers are not listed in the available data, so a version check against the latest releases is recommended.

The CVSS score of 8.4 signals a high severity risk. No EPSS score is provided, and the issue is not currently catalogued in CISA KEV, suggesting lower publicly observed exploitation but still significant threat if key secrecy is crucial. Attackers who can influence or observe the PUF state may predict the user keys, potentially allowing unauthorized decryption or impersonation. The likely attack vector is local or physical access to the device where the PUF is employed.