CVE-2025-2838: (Pwn2Own) Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability
Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2838?
CVE-2025-2838 is classified as a denial-of-service vulnerability that can impact system availability.
How do I fix CVE-2025-2838?
To mitigate CVE-2025-2838, it is recommended to apply the latest security patches provided by Silicon Labs for Gecko OS.
Who is affected by CVE-2025-2838?
CVE-2025-2838 affects installations of Silicon Labs Gecko OS that are exposed to network-adjacent attackers.
Can CVE-2025-2838 be exploited remotely?
Yes, CVE-2025-2838 can be exploited by network-adjacent attackers without the need for authentication.
What is the impact of CVE-2025-2838?
The impact of CVE-2025-2838 is a denial-of-service condition, which can render affected systems unresponsive.