The RS9116 hardware random number generator exhibits timing limitations when the device is in power‑save mode, causing its output to become predictable. This flaw reduces the entropy of random values used in cryptographic operations such as key creation, secure communication handshakes, and authentication. If an attacker can anticipate the random outputs, they could forge keys or decrypt protected data, undermining both confidentiality and integrity.

Silicon Labs RS9116 SDK is affected. No specific SDK release version is listed, so all firmware built with the current SDK may be vulnerable unless a newer build incorporates the fix.

The CVSS score of 7.4 indicates high severity, while the EPSS score is unavailable and the vulnerability is not recorded in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local device access or proximity, as the flaw requires the device to be in power‑save mode during HRNG operations, enabling an attacker to predict the random outputs. Attackers would need access to a device running the affected SDK in power‑save mode, but because the HRNG output becomes deterministic, exploitation could be carried out with minimal effort once the attacker observes or predicts the RNG probability distribution.