CVE-2023-6387 is a high severity buffer overflow in the Bluetooth LE HCI CPC sample application of the Silicon Labs Gecko SDK. It may lead to denial of service or remote code execution. The record links Gecko SDK release v4.4.0 and a Silicon Labs notice, so confirm the fixed version there.
What's affected
- Product: Silicon Labs Gecko SDK, in the Bluetooth LE HCI CPC sample application.
- Affected: the record gives no version range. It links the Gecko SDK v4.4.0 release page and a Silicon Labs community notice.
- Fixed: confirm in the notice. Release 4.4.0 is the version the record points to, but the record does not state it as the fix.
- Attack vector: adjacent network (the vector has AV:A), so the attacker must be in Bluetooth range.
The record gives a CVSS 3.1 base score of 7.5 (high) with the vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
Check whether your firmware was built from the Gecko SDK and whether it includes the BLE HCI CPC sample app.
grep -ri "ble_hci" --include=*.slcp --include=*.slcc .
git -C path/to/gecko_sdk describe --tags
The first command looks for the sample app in your project files. The second prints the SDK tag if you track the SDK through git. If the SDK version is older than 4.4.0, read the Silicon Labs notice.
What to do now
- Find firmware projects that start from the Gecko SDK BLE HCI CPC sample.
- Read the Silicon Labs community notice linked in the record to confirm affected and fixed versions.
- Rebuild against the fixed SDK version and plan the firmware update for deployed devices.
- If you only used the sample for evaluation, remove it from production images.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-125 (Out-of-bounds Read): Code reads memory beyond the buffer it was given, which can leak data or crash the process. ; CWE-787 (Out-of-bounds Write): Code writes outside the memory it owns, which can corrupt data, crash the program, or in some cases allow code execution. ; CWE-131 (Incorrect Calculation of Buffer Size): A buffer is sized wrongly for the data that will go into it, which sets up later overflows or over-reads.
Three weaknesses are listed: an out-of-bounds read, an out-of-bounds write and an incorrect buffer size calculation. They tend to travel together. A length is computed wrongly, a copy trusts it, and memory beyond the buffer is touched.
The base score is high even with high attack complexity because the impact covers confidentiality, integrity and availability. Embedded devices are slow to update, so finding which products shipped the sample app is the hard part. Treat it as a bill of materials question first.
Quick check
Is this in every Gecko SDK product?
No. The record limits it to the Bluetooth LE HCI CPC sample application. Projects that do not use the sample are not described as affected.
Does the attacker need to be nearby?
Yes. The vector shows an adjacent network attack.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
