CVE-2023-4280 is a critical (CVSS 9.3) input validation flaw in the Silicon Labs TrustZone implementation in Gecko SDK 4.3.x and earlier. It lets untrusted code reach the trusted memory region. Check the Silicon Labs advisory for the fixed SDK release, then rebuild and reflash affected firmware.
What's affected
The NVD record says unvalidated input in the Silicon Labs TrustZone implementation, in version 4.3.x and earlier of the Gecko SDK, allows an attacker to access the trusted region of memory from the untrusted region.
The record lists the Gecko SDK as the affected product and points to the Silicon Labs community advisory and the SDK repository on GitHub. Both could not be retrieved in a readable form when we reviewed this entry, so we do not state a fixed SDK version. Open the advisory and confirm the first fixed release.
This is a firmware component issue. It affects products that embed the SDK, so the people who need to act are the device makers who build firmware with it, and the buyers of those devices who need a vendor update.
How to check if you're exposed
Look at the SDK version in your firmware project. Simplicity Studio and the SDK repository both show the version of the Gecko SDK that your project builds against.
Then check whether your project uses the TrustZone feature at all. If your target part and your build do not enable the secure and non secure split, the trusted region boundary in this record may not matter to you, but confirm that against the advisory.
For devices you buy rather than build, ask the manufacturer whether their firmware embeds the Gecko SDK and which version, and request an updated image if it does.
Keep a firmware bill of materials per product so that this kind of question takes minutes instead of days.
What to do now
- Identify every firmware product and prototype that builds on Gecko SDK 4.3.x or earlier.
- Read the Silicon Labs advisory and select the fixed SDK release.
- Update the SDK in your build environment, rebuild, test and reflash.
- Plan field updates for devices that are already deployed, and check that your update path does not itself depend on the trusted region.
- For purchased devices, ask the vendor for a patched firmware and its date.
Why it matters
The record lists two CWE entries, CWE-125, CWE-787. Both are memory safety classes: reading outside intended bounds and writing outside intended bounds. In a TrustZone design the point of the secure region is that non secure code cannot touch it, so a validation gap at that boundary defeats the main isolation promise.
That is why the score is critical even though the attack may need code already running on the device. Secrets, keys and update logic often live in the secure world. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Who needs to act, device makers or device buyers?
Both. Makers rebuild with the fixed SDK, and buyers should ask the maker for updated firmware, because they cannot rebuild it themselves.
Sources
Last reviewed: 19 October 2026.
