CVE-2024-22472
Published: 07 May 2024
Summary
CVE-2024-22472 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Silabs (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 11.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A buffer overflow vulnerability, tracked as CVE-2024-22472 and assigned CWE-120, affects Silicon Labs 500 Series Z-Wave devices running all versions of the 500 Series SDK prior to v6.85.2. The flaw stems from insufficient input size validation during buffer operations and carries a CVSS 3.1 score of 8.1.
An unauthenticated attacker with network access can trigger the overflow, although successful exploitation requires high attack complexity. Successful attacks may result in denial of service or, under certain conditions, remote code execution on the affected Z-Wave devices.
The referenced Silicon Labs community advisories direct users to upgrade to SDK version 6.85.2 or later to address the issue.
The EPSS score rose from a low baseline to a peak of 0.0763 on 2025-12-11 before receding to the current value of 0.0410.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20016
Vulnerability details
A buffer Overflow vulnerability in Silicon Labs 500 Series Z-Wave devices may allow Denial of Service, and potential Remote Code execution This issue affects all versions of Silicon Labs 500 Series SDK prior to v6.85.2 running on Silicon Labs 500…
more
series Z-wave devices.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.