{"id":"CVE-2026-107359","kind":"vulnerability","aliases":["CVE-2026-107359"],"related":[],"title":"WF200 firmware: beacon handler input flaw causes divide-by-zero fault","description":"Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.","summary":"Improper input validation in the beacon handler of WF200 firmware 3.17.0 and earlier can trigger a divide-by-zero fault. The sources do not say whether this crashes the device or allows anything beyond a fault.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WF200 firmware","fixed":[],"affected":"<= 3.17.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","embedded","firmware","infrastructure","silicon-labs","wf200","wifi"],"not_affected_if":[],"how_to_check":"Read the WF200 firmware version loaded by your host driver (the wfm_wf200_C0.sec file in /lib/firmware on Linux with the wfx driver, or the version in the startup indication) and compare it to 3.17.0. Also check if you use WFM200 modules, which share the WF200 firmware line; no source confirms they are affected.","fix":null,"status":"open","published_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","triaged_at":"2026-11-05T18:40:35+00:00","updated_at":"2026-11-05T18:42:39+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-05T18:40:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WF200 firmware: beacon handler input flaw causes divide-by-zero fault","impact":"low","summary":"Improper input validation in the beacon handler of WF200 firmware 3.17.0 and earlier can trigger a divide-by-zero fault. The sources do not say whether this crashes the device or allows anything beyond a fault.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wf200","firmware","embedded"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"device crashes or faults from a divide-by-zero","analyst_note":"Find the vendor advisory and fixed firmware version for WF200 beyond 3.17.0; confirm reach and whether the fault allows more than a crash, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-107359.","how_to_check":"- Check the WF200 firmware version on the device against `3.17.0`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"WF200 devices running firmware 3.17.0 or earlier are affected, according to the NVD description. The sources do not say how the beacon handler is reached or which deployments are most exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4174,"output_tokens":511,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and fixed firmware version for WF200 beyond 3.17.0; confirm reach and whether the fault allows more than a crash, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-107359.","search":"'-107359':15A,18A '-2026':14A,17A '3.17.0':43B,81C 'allow':65B 'anyth':66B 'beacon':3A,38B,75C 'beyond':67B 'caus':7A 'crash':61B 'cve':13A,16A 'denial':22B 'denial-of-servic':21B 'devic':63B 'divid':9A,50B,89C 'divide-by-zero':8A,49B,88C 'earlier':45B,83C 'embed':25B 'fault':12A,53B,69B,92C 'firmwar':2A,26B,42B,79C 'firmware':20A 'flaw':6A 'handler':4A,39B,76C 'improp':33B,70C 'infrastructur':27B 'input':5A,34B,71C 'lab':30B 'may':84C 'result':85C 'say':58B 'servic':24B 'silicon':29B 'silicon-lab':28B 'sourc':55B 'trigger':47B 'valid':35B,72C 'version':80C 'wf200':1A,19A,31B,41B,78C 'whether':59B 'wifi':32B 'zero':11A,52B,91C","nicknames":[],"mitigations":[],"who_affected":"Devices with a Silicon Labs WF200 Wi-Fi chip running firmware 3.17.0 or earlier are affected, per NVD. The CVSS 4.0 vector from Silicon Labs is adjacent-network, no privileges, no user interaction, with impact on availability only. That points to a device in Wi-Fi range being able to cause a fault, with no data impact rated. The sources do not say whether the fault is a crash or a reset. Skip it if you do not ship WF200-based products.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["firmware","wf200firmware"],"ptokens":["firmware","wf200"],"labels":["denialofservice","embedded","firmware","high","infrastructure","siliconlabs","wf200","wifi"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"product-security@silabs.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107359","severity":null,"published_at":"2026-11-05T18:17:00+00:00","modified_at":"2026-11-05T18:17:00+00:00","first_seen_at":"2026-11-05T18:40:09+00:00","fetched_at":"2026-11-05T18:40:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107359:1820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107359","severity":null,"published_at":"2026-11-05T18:42:39+00:00","modified_at":"2026-11-05T18:42:39+00:00","first_seen_at":"2026-11-05T18:42:39+00:00","fetched_at":"2026-11-05T18:42:39+00:00","note":"Only NVD found; Silicon Labs advisory not located (dashboard is JS-only, no CVE text on web search). The firmware CHANGES.md lists 3.17.0 as the newest release (2023-10-25) and has no fix entry, so the fixed version is unknown. The vendor does not say no fix exists, so fix_status is left unset. Nothing verified. Check the Silicon Labs advisory dashboard for the CVE later.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-107359","https://github.com/SiliconLabs/wfx-firmware/blob/master/CHANGES.md"]}],"documents":[{"id":78888,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107359","title":"NVD CVE-2026-107359","kind":"other","source":"analyst","publisher":null,"text":"Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault. CNA: product-security@silabs.com. CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H (7.1 high).","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":78887,"url":"https://github.com/SiliconLabs/wfx-firmware/blob/master/CHANGES.md","title":"WFx Firmware Release Note (CHANGES.md)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}