A bug in the entropy initialization for Silicon Labs SiWx917 causes the DRBG to use a predictable seed. As a result, all random numbers generated in the Matter code use an identical stream of numbers, effectively eliminating the randomness that secures cryptographic operations. The weakness is classified as CWE-336, indicating a flaw in random number generation and entropy management. This defect could allow an attacker to forecast the random values employed in key generation, session tokens, or other security‑critical functions, thereby undermining confidentiality, integrity, and authenticity of the Matter implementation.

The vulnerability affects the Silicon Labs Matter project, specifically the SiWx917 device implementation using the TinyCrypt library path. No specific release or version is listed, and the impacted repository has already been deprecated, which limits direct applicability to newer iterations of the product. The affected systems are therefore legacy Matter firmware or software that incorporates the SiWx917 TinyCrypt code untouched.

The CVSS score of 8.7 indicates a high severity level, while the EPSS score of < 1% points to a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. Based on the description, the attack likely requires the attacker to interact with a device or process that uses the insecure DRBG; the exact vector is not detailed, so it could be local or remote, depending on how the random numbers are utilized. When functional, the exploit would let an adversary predict all random outputs, compromising cryptographic security without the need for privileged access.