CVE-2025-2837

Deeper analysis

Silicon Labs Gecko OS contains a stack-based buffer overflow vulnerability in its HTTP request handling logic, identified as CVE-2025-2837 and originally reported as ZDI-CAN-23245. The flaw arises from missing validation on the length of attacker-supplied data before it is copied into a fixed-size stack buffer, enabling uncontrolled memory corruption on affected device installations.

Network-adjacent attackers require no authentication or user interaction to trigger the issue and can achieve arbitrary code execution in the context of the Gecko OS process. The vulnerability is rated 8.8 under CVSS 3.0 with an attack vector of adjacent network, low complexity, and full impact on confidentiality, integrity, and availability.

Public advisories from Zero Day Initiative and Silicon Labs are available at the referenced URLs and provide further details on affected versions and remediation steps. The associated EPSS score has remained low, with a current value of 0.0178 and a recorded peak of 0.0283.