CVE-2023-5138
Silabs Gecko Software Development Kit 1.0.0 – 4.4.0
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-5138 is a medium-severity EM-FI (CWE-1319) vulnerability in Silabs Gecko Software Development Kit. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-18 (Tamper Resistance and Detection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57476
Vulnerability Data
Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing initialization through static analysis or test cases.
Tamper-resistance requirements directly drive hardware protections that block EM fault injection from reaching internal state or bypassing checks.
Mandating a tamper-protection program for components forces implementation of EM-FI countermeasures during development and supply-chain handling.
Documented development standards and processes can mandate initialization of critical resources.
Security engineering principles can require explicit resource initialization during design and coding.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Physical-environment monitoring can detect EM-FI attempts or related tampering.
Managing physical access directly reduces the opportunity to perform EM-FI attacks.
Protecting assets from environmental threats encompasses electromagnetic fault-injection vectors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Physical and environmental threat protection directly addresses EM-FI risk through shielding and environmental controls.
Secure development life cycle mandates initialization of resources before use.
Secure system architecture principles can include hardware-level countermeasures against EM-FI, though the control is not specific to this threat.
Security testing in development can discover EM-FI susceptibility, but does not inherently prevent the weakness in production.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-909, a class-level weakness, and none of its children carries one either.