# Silicon Labs Security Advisory A-00000533 : Security advisory for OpenThread denial of service vulnerability

Flags: OpenThread

CVSS Severity: Medium

CVSS Base Score: 5.3, Medium

CVSS String: [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)

## Product Impact

| Product | Impacted Version | Main SDK | Impacted Version | CVE |
| --- | --- | --- | --- | --- |
| OpenThread | 2.6.2 through 2.6.0 | SiSDK | 2024.12.2 through 2024.12.0 | [CVE-2025-2329](https://nvd.nist.gov/vuln/detail/CVE-2025-2329) |
| OpenThread | 2.5.2 through 2.5.0 | SiSDK | 2024.6.3 through 2024.6.0 | [CVE-2025-2329](https://nvd.nist.gov/vuln/detail/CVE-2025-2329) |
| OpenThread | 2.4.6 and earlier | GSDK | 4.4.6 and earlier | [CVE-2025-2329](https://nvd.nist.gov/vuln/detail/CVE-2025-2329) |

### Source Product Impact Details

- OpenThread RCP capable ICs and associated modules such as EFR32MGxxx

Note: As of June 2024, the Gecko SDK was renamed to the Simplicity SDK and the versioning scheme was changed from Gecko SDK vX.Y.Z to Simplicity SDK YYYY.MM.Patch#.

| Product | Impacted Version |
| --- | --- |
| EFR32MGxxx | OpenThread V2.4.6 and earlier, delivered as part of GSDK 4.4.6, and earlier |
| EFR32MGxxx | OpenThread 2.5.0 through 2.5.2, delivered as part of SiSDK 2024.6.0 through 2024.6.3 |
| EFR32MGxxx | OpenThread 2.6.0 through 2.6.2 delivered as part of SiSDK 2024.12.0 through 2024.12.2 |

## CVE ID(s)

| CVE Number | Description | CVSS Severity | Vector String |
| --- | --- | --- | --- |
| [CVE-2025-2329](https://nvd.nist.gov/vuln/detail/CVE-2025-2329) | Heavy traffic environment results in denial of service | Medium | [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) |

## Description

- In high traffic environments, the RCP may send a SPI packet with a corrupt header. Upon receiving the corrupt packet, the host will reset the RCP device leading to a temporary denial of service 
- The error condition is immediately cleared once the device has been reset 

### Fix/Workaround

- Users affected by [CVE-2025-2329](https://nvd.nist.gov/vuln/detail/CVE-2025-2329) should upgrade their OpenThread SDK according to the table below.
- Instructions for [downloading/updating the SDK](https://docs.silabs.com/simplicity-studio-5-users-guide/latest/ss-5-users-guide-about-the-launcher/toolbar#install) and for [upgrading a project](https://docs.silabs.com/simplicity-studio-5-users-guide/latest/ss-5-users-guide-getting-started/project-upgrade-new-gsdk-version) can be found in the Simplicity Studio Users Guide

| Product | Fix Version | Bug ID | Release Notes |
| --- | --- | --- | --- |
| SiSDK | 2025.6.0 | 1420021 | [https://docs.silabs.com/sisdk-release-notes/latest/sisdk-ot-release-notes/sisdk-ot-sdk-release-notes#bug-fixes](https://docs.silabs.com/sisdk-release-notes/latest/sisdk-ot-release-notes/sisdk-ot-sdk-release-notes#bug-fixes) |

No other fixes are planned at this time.

## Revision History

| Rev | Date | Description of Changes |
| --- | --- | --- |
| 1.0 | 2025-JUL-24 | Initial publication |

## Attribution

## Additional Resources

- Security policy: [https://www.silabs.com/security](https://www.silabs.com/security)

- Technical support: [https://www.silabs.com/support](https://www.silabs.com/support)