Is CVE-2026-4930 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4930 being exploited in the wild.

How severe is CVE-2026-4930?

Informational severity, with a CVSS score of 7.1, published 25 June 2026.

Which products and versions are affected?

Silicon Labs Simplicity SDK (SiSDK) All versions using SiXG301 SYMCRYPTO engine.

Is there a fix for CVE-2026-4930?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4930 attacked?

It is attacked with physical access or with local access, in device firmware.

Am I affected by CVE-2026-4930?

Check whether you run Silicon Labs Simplicity SDK (SiSDK) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4930: Silicon Labs SiXG301 insufficient entropy in SYMCRYPTO DPA countermeasures

CVE-2026-4930 · Severity: info · CVSS 7.1 · Published 2026-06-25

A vulnerability exists in the hardware cryptographic engine of certain Silicon Labs chips used to secure data and communications. If an attacker already has the ability to run code on the device, they can weaken the protections designed to prevent the theft of secret encryption keys. This could allow a sophisticated attacker with physical access to the device to extract sensitive keys, potentially compromising the privacy and security of the entire system.

Vendors: Silicon Labs.

Quick answers

Is CVE-2026-4930 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4930 being exploited in the wild.
How severe is CVE-2026-4930?: Informational severity, with a CVSS score of 7.1, published 25 June 2026.
Which products and versions are affected?: Silicon Labs Simplicity SDK (SiSDK) All versions using SiXG301 SYMCRYPTO engine.
Is there a fix for CVE-2026-4930?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4930 attacked?: It is attacked with physical access or with local access, in device firmware.
Am I affected by CVE-2026-4930?: Check whether you run Silicon Labs Simplicity SDK (SiSDK) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SYMCRYPTO hardware engine, used by the PSA crypto library for AES and hashing operations on SiXG301 devices, is vulnerable to a reduction in entropy for its Differential Power Analysis (DPA) countermeasures. An attacker who has already achieved high-privilege code execution on the device can force specific seed values, thereby weakening the randomness used to mask cryptographic operations. This makes the device susceptible to side-channel attacks, specifically DPA, which can lead to the extraction of symmetric keys. The vulnerability is tracked as CWE-331 (Insufficient Entropy) and requires physical access to perform the power analysis after the software-based seed manipulation.

Affected products

Silicon Labs Simplicity SDK (SiSDK) All versions using SiXG301 SYMCRYPTO engine

Timeline

2026-06-25: disclosed: Initial disclosure by Silicon Labs
2026-06-25: advisory: NVD record published

References

https://community.silabs.com/068Vm00000sjHs3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.