The vulnerability resides in Connect SDK versions 4.3.1 and older, and Flex SDK versions 3.7.7 and older. A malicious message containing invalid security settings can bypass the authentication process and cause a disruption to network connectivity. The attack does not permit an attacker to acquire the network key or compromise confidentiality.

Devices running Silicon Labs Connect SDK or Flex SDK that have not been updated beyond the mentioned version thresholds are affected. Systems that rely on these SDKs for mesh networking or secure communication are exposed to this authentication bypass.

The CVSS score of 7.2 reflects a serious risk, though no evidence indicates that the vulnerability has been actively exploited and it is not listed in CISA’s KEV catalog. Because the exploit requires sending a crafted message to a device that accepts the SDK, the attack vector is likely network-based and would be limited to devices that are exposed or on the same network segment. Once the authentication bypass occurs, a local attacker can interrupt network services, though full code execution or key compromise is outside the scope of this flaw.