# CVE-2026-3290: Silicon Labs RS9116 predictable HRNG values in power save mode

Source: https://junglewise.ai/threats/cve-2026-3290-silicon-labs-rs9116-predictable-hrng-values-in-power-save-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-3290 · Severity: info · CVSS 7.4 · Published 2026-05-14

A security issue exists in the Silicon Labs RS9116 Wi-Fi and Bluetooth module, which is commonly used in IoT devices. When the device is in power-saving mode, the component responsible for generating random numbers produces predictable results. This could allow an attacker to bypass security protections, potentially leading to the interception of private communications or unauthorized access to the device.

Vendors: [Silicon Labs](https://junglewise.ai/threats/vendors/silicon-labs).

## Quick answers

**Is CVE-2026-3290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3290 being exploited in the wild.

**How severe is CVE-2026-3290?** Informational severity, with a CVSS score of 7.4, published 14 May 2026.

**Which products and versions are affected?** Silicon Labs RS9116 Wi-Fi/Bluetooth SDK All versions prior to fix.

**Is there a fix for CVE-2026-3290?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-3290 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-3290?** Check whether you run Silicon Labs RS9116 Wi-Fi/Bluetooth SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Hardware Random Number Generator (HRNG) of the Silicon Labs RS9116 Wi-Fi/Bluetooth solution. When power save mode is active, timing limitations within the HRNG hardware result in insufficient entropy, leading to the generation of predictable random values (CWE-332). An attacker within adjacent network range could exploit this predictability to compromise cryptographic protocols that rely on the HRNG for nonces, keys, or salts. This could result in high confidentiality and integrity impacts. The issue is addressed in the WiseConnect Wi-Fi/BT SDK.

## Affected products

- Silicon Labs RS9116 Wi-Fi/Bluetooth SDK All versions prior to fix

## Timeline

- 2026-05-14: advisory: NVD publication date

## References

- [https://github.com/SiliconLabs/wiseconnect-wifi-bt-sdk/](https://github.com/SiliconLabs/wiseconnect-wifi-bt-sdk/)
- [https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000nIg6IIAS?operationContext=S1](https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000nIg6IIAS?operationContext=S1)