CVE-2026-17610 Overview
CVE-2026-17610 is a denial-of-service vulnerability in Silicon Labs SiSDK version 2026.6.0 and earlier. The flaw affects EFR32MG24 and EFR32MG26 devices operating concurrent multiprotocol Zigbee and Thread stacks. Under high network traffic loads, the affected devices drop acknowledgement (ACK) frames, leading to a denial-of-service condition on the wireless interface. The issue is categorized under [CWE-404: Improper Resource Shutdown or Release]. Exploitation requires adjacent network access on the same wireless segment, and no privileges or user interaction are needed. The vulnerability affects availability only; confidentiality and integrity are not impacted.
Critical Impact
An adjacent attacker generating high volumes of wireless traffic can cause dropped ACKs on EFR32MG24 and EFR32MG26 devices running concurrent Zigbee and Thread, resulting in loss of availability for the affected radio protocol.
Affected Products
- Silicon Labs SiSDK versions 2026.6.0 and earlier
- EFR32MG24 devices running concurrent multiprotocol Zigbee and Thread
- EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread
Discovery Timeline
- 2026-08-28 - CVE-2026-17610 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-17610
Vulnerability Analysis
The vulnerability affects the concurrent multiprotocol stack in Silicon Labs SiSDK, which coordinates Zigbee (IEEE 802.15.4) and Thread operation on a single radio. Under sustained high traffic conditions, the stack fails to reliably transmit or process link-layer acknowledgement frames. Dropped ACKs disrupt normal frame delivery on 802.15.4 based mesh networks, causing retransmissions, timeouts, and eventual loss of network availability for affected nodes.
The defect is classified as [CWE-404: Improper Resource Shutdown or Release], indicating that resource contention or exhaustion in the multiprotocol scheduler prevents proper ACK handling when both protocols contend for radio time.
Root Cause
The root cause lies in how the concurrent multiprotocol scheduler in SiSDK arbitrates radio access between the Zigbee and Thread stacks. High traffic loads exhaust the scheduler's ability to service both protocols within the strict 802.15.4 ACK timing window (approximately 192 microseconds). ACK frames that miss this window are dropped, breaking reliable delivery.
Attack Vector
An attacker within radio range of an affected device can trigger the condition by injecting or generating sustained high-rate 802.15.4 traffic. This can be accomplished with commodity 802.15.4 sniffers or transmitters configured to flood the affected channel. No authentication or pairing with the target network is required because the resource contention occurs at the radio scheduler level, below application-layer security.
Refer to the Silicon Labs SDK Release on GitHub and the Silicon Labs advisory document for vendor technical details.
Detection Methods for CVE-2026-17610
Indicators of Compromise
- Elevated rates of 802.15.4 MAC-layer retransmissions on Zigbee or Thread interfaces of EFR32MG24 and EFR32MG26 devices.
- Loss of connectivity or route failures on multiprotocol nodes coincident with high channel utilization.
- Sustained abnormal RF traffic patterns on the operating channel observed via wireless sniffers.
Detection Strategies
- Monitor Zigbee and Thread network diagnostics for ACK failure counters, MAC retry counts, and packet loss on multiprotocol devices.
- Deploy 802.15.4 packet captures to identify sustained high traffic volumes on channels used by affected devices.
- Correlate device reboots, join failures, or radio timeouts across the mesh to detect coordinated availability disruption.
Monitoring Recommendations
- Establish baselines for normal channel utilization and MAC retry rates in production Zigbee and Thread deployments.
- Alert on threshold breaches for MAC-layer ACK failures on EFR32MG24 and EFR32MG26 firmware built with SiSDK 2026.6.0 or earlier.
- Log firmware version and SDK build metadata from fielded devices to support triage when availability issues occur.
How to Mitigate CVE-2026-17610
Immediate Actions Required
- Inventory all EFR32MG24 and EFR32MG26 devices running concurrent Zigbee and Thread, and identify those built against SiSDK 2026.6.0 or earlier.
- Upgrade to the fixed SiSDK release published by Silicon Labs and rebuild affected firmware images.
- Deploy updated firmware to fielded devices using existing OTA or field-service processes.
Patch Information
Silicon Labs has published the fix in the SiSDK release tracked at the SiliconLabsSoftware sisdk-release repository. Consult the Silicon Labs advisory document for the specific fixed version and integration guidance for downstream firmware projects.
Workarounds
- Where multiprotocol operation is not required, disable either Zigbee or Thread to eliminate scheduler contention on affected devices.
- Segment sensitive Zigbee and Thread deployments onto RF-isolated channels or physical locations to reduce exposure to adjacent-network flooding.
- Enforce transmit-rate limiting on trusted co-located devices to reduce baseline channel utilization on shared 802.15.4 channels.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.