CVE-2025-2838 MEDIUM

CVE-2025-2838: Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability

Vendor Silicon Labs
Product Gecko OS
Weakness CWE-835
Published March 26, 2025
Last update March 27, 2025

CVSS base score

6.5/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.

Key dates

02Disclosure timeline

March 26, 2025 CVE published
March 27, 2025 Record updated