CVE-2023-2747
Uninitialized IV in Silicon Labs SE FW v2.0.0 through v 2.2.1 for internally stored data
The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Uninitialized IV in Silicon Labs SE FW v2.0.0 through v 2.2.1 for internally stored data
The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.
- Record
CVE-2023-2747- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-1204
- Updated
- 2026-11-02
EUVDEUVD-2023-34208
The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.
- Record
EUVD-2023-34208- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36qx-fccg-6873
The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in...
The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.
- Record
GHSA-36qx-fccg-6873- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-908, CWE-1204
- Updated
- 2026-11-02
NVD
The initialization vector (IV) used by the secure engine (SE) for encrypting data stored in the SE flash memory is uninitialized.
- Record
CVE-2023-2747- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1204, CWE-908
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2747 is a low vulnerability (CVSS 3.1) in Silabs Gecko Software Development Kit, published June 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. No source names a fixed version.