Security Vulnerability FAQs

To report a product security vulnerability, please register and create an account at community.silabs.com and click on the "Vulnerability Disclosure" tab on the top right hand corner to select the "Vulnerability Report Submission" option in the drop down menu.

To report an enterprise asset security vulnerability, please register and create an account at community.silabs.com and click on the "Vulnerability Disclosure" tab on the top right-hand corner to select the "Vulnerability Report Submission" option in the drop-down menu.

Please provide: 

• A clear description of the vulnerability. 
• Affected product(s) and version(s). 
• Steps to reproduce the issue. 
• Potential impact (e.g., data breach, system compromise). 
• Any proof-of-concept code or screenshots (if applicable). 
• Your contact information for follow-up. 
• Attribution details, if attribution is preferred.
• For coding vulnerabilities, please point to the exact location of the vulnerable files.

This helps our PSIRT assess and address the issue quickly.

Since registration involves an email address, and requires communication to address an issue, anonymity is likely going to be based on the information you provide at registration. In addition, the eligibility for our Bug Bounty Program will require some level of self-identification to be provided with directions on rewards. 

The vulnerability is assessed based on several factors, which determine its priority.  The approach to resolving the issue then follow and an advisory or disclosure is made for the vulnerability and fix, if applicable. 

Disclosure: We publish a security advisory to notify subscribed users of the vulnerability. To learn how to sign up for security advisory notifications, click here. 

Yes, we adhere to coordinated vulnerability disclosure principles. We work with reporters to validate and remediate vulnerabilities before public disclosure, minimizing risk to our customers. We aim to publish security advisories alongside available fixes. In certain cases, a fix may not be released.  

Researchers are welcome to reference the public security advisory and published CVEs in their communications or publications.

You can view previously published security advisories in our GitHub page.

You can sign up for email notifications when a new Security Advisory is published by Watching the security advisory GitHub repo. Note that a GitHub account is needed to watch GitHub repos. You will receive notifications whenever a new advisory is published. The filterable dashboard linked in the repo description can be used to determine if any of the advisories are relevant to your product(s).

Yes, our Bug Bounty Program rewards eligible submissions based on the vulnerability’s severity and impact. See our Vulnerability Disclosure Program (VDP) FAQ for eligibility, scope, and reward details. 

Qualifying vulnerabilities include those affecting our semiconductor products, firmware, or related software. Some common vulnerabilities that we have rewarded have been related to:

• Memory corruption
• Cryptographic flaws
• Buffer overflows

Vulnerabilities discovered in our enterprise assets do not qualify for the bug bounty and are only part of the Vulnerability Disclosure Program. See our security vulnerability disclosure policy for more details.

Once you register as a researcher at community.silabs.com, and meet the requirements listed in the security vulnerability disclosure policy, you should be able to participate in the bug bounty program. 

We only pay for confirmed vulnerabilities, that had not already been reported. Payments depend on the priority that Silicon Labs assigns to the vulnerability after internal review.  The pricing of the bounty by priority is available in the Vulnerability Disclosure Program (VDP) FAQ.

To report an enterprise asset security vulnerability, please register as a researcher at community.silabs.com and from there you will be able to submit vulnerability reports.

Our Product Security Incident Response Team (PSIRT) manages the identification, assessment, and resolution of security vulnerabilities in our products. We coordinate with researchers, customers, and partners to ensure timely fixes and transparent communication. 

We prioritize fixes using a combination of industry standards and internal assessments. We utilize the Common Vulnerability Scoring System (CVSS) 4.0, as well as other internal criteria, which enables us to assess the severity of each issue. Critical vulnerabilities receive the highest priority, and we aim to disclose and resolve them within 90 days.

Yes, we are a CNA (CVE Numbering Authority). This enables us to assign CVEs to confirmed vulnerabilities when appropriate, facilitating the public disclosure of security issues. We include relevant CVE numbers in each security advisory. 

We take data privacy seriously. Reports are handled confidentially, stored securely, and shared only with team members involved in resolution.