Executive brief
A security flaw was identified in Silicon Labs SiWx917 devices using the Matter connectivity standard, where the system fails to generate truly random numbers. Because the system uses a predictable starting point for its random number generator, security features like encryption keys or session identifiers could be guessed by an attacker. This could allow unauthorized parties to intercept or decrypt communications between smart home devices.
Technical details
A vulnerability exists in the entropy initialization process for Silicon Labs SiWx917 hardware when utilizing the Matter protocol stack. The root cause is a failure to provide sufficient entropy to the Deterministic Random Bit Generator (DRBG), leading to the use of a predictable seed (CWE-336). Consequently, all cryptographic operations or protocol functions relying on the PRNG in the Matter code use a predictable stream of numbers. An attacker could exploit this over the network to predict sensitive values such as cryptographic keys or nonces. The vulnerability was identified in a repository that has since been deprecated.
Affected products
- Silicon Labs Matter GitHub Repository All versions prior to deprecation
Timeline
- 2026-07-23: advisory: CVE-2026-6924 published by Silicon Labs