CVE-2026-2815

HighCVSS 8.4/10Last modified Jun 25, 2026

Description

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys

Metrics

CVSS 4.0 8.4/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-339

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-281508.1Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.CVE-2026-281518.1Unauthenticated Local File Inclusion in Tonda < 2.6 versions.CVE-2026-281528.1Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.CVE-2026-281537.5Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More CVE-2026-281547.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WCVE-2026-281556.5Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.CVE-2026-281568.5Subscriber SQL Injection in Do Lasso <= 358 versions.CVE-2026-281577.5Subscriber Path Traversal in Do Lasso <= 358 versions.CVE-2026-281587.1Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.CVE-2026-281596.5Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.CVE-2026-281618.8Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.CVE-2026-281627.1Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
CVE-2026-2815: High severity, CVSS 8.4 | Vulnix