CVE-2023-41094
Silabs Emberznet 7.1.3 – 7.1.5
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2023-41094 is a critical-severity Improper Verification of Source of a Communication Channel (CWE-940) vulnerability in Silabs Emberznet. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique ARP Cache Poisoning (T1557.002); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-45614
Vulnerability Data
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration…
more
This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V3.5.3V10.6.2V15.2.4
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enforces verification of the source of a communication channel by requiring identification and authentication of services first.
Ensures network resources are released once the session ends or becomes inactive, closing the window for missing-release weaknesses.
Requires explicit verification of the source and integrity of the channel used for authentication and other security functions.
Provides the means to verify the source of name-resolution responses instead of relying on unauthenticated channels.
Requires explicit verification of the communication source, blocking session hijacking via spoofed or alternate channels.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authentication of users/services/hardware directly enforces source verification for communication channels.
Lifecycle management explicitly requires handling resources through end-of-life including release.
Verifying identity assertions prevents spoofed channel origins but does not cover all channel-establishment scenarios.
Enforcing managed authorizations and revocations directly prevents post-release operations on credentials or entitlements.
Secure development practices eliminate the root coding flaw that permits use-after-release.
Runtime monitoring may surface resource-exhaustion symptoms but does not address release logic.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Explicit information-deletion requirements directly address timely release of resources after use.
Security testing can detect use-after-release but does not prevent it at runtime.
Secure authentication mechanisms verify the identity and origin of communication channel initiators.
Network security controls enforce source verification and channel authentication for incoming communications.
Security of network services includes validating the origin of service requests and connections.
Network segregation limits exposure but does not directly verify source of individual channels.