CVE-2026-3290

Executive Summary

CVE-2026-3290 describes a critical weakness in the hardware random number generator (HRNG) of the Silicon Labs (formerly Redpine Signals) RS9116 Wi-Fi SoC when power save mode is enabled. The vulnerability stems from timing limitations in the entropy source, causing the HRNG to produce predictable values. This predictability can allow an attacker to compromise cryptographic operations that rely on the HRNG output, such as session key generation, authentication tokens, or TLS handshakes.

The RS9116 is widely used in IoT, industrial, and embedded devices. The vulnerability is particularly dangerous because it is triggered by a common power-saving feature, making it likely to affect many deployed devices. No public exploit code or proof-of-concept is available at this time, but the risk is high due to the fundamental nature of the flaw.

Supply Chain & Package Security

The RS9116 is a hardware component, not a software package. However, its firmware and SDK (WiSeConnect) are distributed by Silicon Labs. The vulnerability exists in the hardware logic and firmware of the chip itself. Any device using the RS9116 in power save mode is potentially affected. Supply chain risk is elevated because the flaw is in the silicon, requiring a hardware revision or firmware patch from the vendor.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 6.2 (Medium)

• Attack Vector (AV): Local (L) – The attacker must have local access to the device or be able to observe its outputs.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions beyond enabling power save mode.
• Privileges Required (PR): None (N) – No privileges needed to trigger the vulnerable state.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Predictable HRNG can leak cryptographic keys.
• Integrity (I): None (N) – No direct integrity impact.
• Availability (A): None (N) – No availability impact.

Threat Level: High (due to the fundamental nature of the flaw and potential for key compromise).

Deep Dive & Mechanics

The RS9116 HRNG is designed to harvest entropy from analog noise sources. When power save mode is enabled, the chip reduces clock speeds and power to various subsystems, including the entropy source. This reduction in power and timing causes the entropy source to produce samples that are less random and more predictable.

The core issue is a violation of the CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation. The HRNG does not maintain sufficient entropy quality under low-power conditions. An attacker who can observe multiple HRNG outputs (e.g., by monitoring network traffic that uses keys generated from the HRNG) can predict future outputs.

The attack scenario:

1. The target device enters power save mode.
2. The device generates a cryptographic key using the HRNG.
3. The attacker captures the key or observes its effects (e.g., encrypted traffic).
4. The attacker uses the predictable nature of the HRNG to derive the key or predict future keys.

Vulnerable vs. Patched Code

No code diff is available because the vulnerability is in hardware/firmware. However, the following pseudocode illustrates the flawed entropy collection:

// Vulnerable HRNG implementation (conceptual)
uint32_t get_random() {
    if (power_save_mode) {
        // Reduced sampling rate leads to correlated values
        return read_entropy_source() & 0xFF; // Only 8 bits of entropy
    } else {
        return read_entropy_source(); // Full 32 bits of entropy
    }
}

A patched version would either disable the HRNG in power save mode or use a cryptographic DRBG (Deterministic Random Bit Generator) seeded with sufficient entropy before entering low power.

// Patched HRNG implementation (conceptual)
uint32_t get_random() {
    if (power_save_mode) {
        // Use a DRBG seeded with high-entropy seed
        return drbg_generate();
    } else {
        return read_entropy_source();
    }
}

Exploitation & Lab Setup

Red Team

Objective: Exploit predictable HRNG to recover cryptographic keys.

Lab Setup:

• RS9116 evaluation board (e.g., RS9116W EVK)
• Silicon Labs WiSeConnect SDK
• A logic analyzer or oscilloscope to observe HRNG output (if hardware access is available)
• Python with scapy for network traffic capture

Steps:

1. Configure the RS9116 to operate in power save mode.
2. Capture multiple HRNG outputs (e.g., by reading the random number register via SPI/UART).
3. Analyze the outputs for patterns (e.g., low entropy, repeating values).
4. If the device uses the HRNG for TLS key generation, capture the TLS handshake.
5. Use the predictable HRNG output to derive the pre-master secret.

Example Python script to analyze HRNG outputs:

import serial
import numpy as np

ser = serial.Serial('/dev/ttyUSB0', 115200)
samples = []
for _ in range(1000):
    ser.write(b'R')  # Command to read random number
    data = ser.read(4)
    samples.append(int.from_bytes(data, 'little'))

# Check for patterns
print("Min:", min(samples))
print("Max:", max(samples))
print("Unique values:", len(set(samples)))
# If unique values << 1000, HRNG is predictable

Blue Team

Objective: Detect and mitigate exploitation attempts.

Detection:

• Monitor for unusual patterns in cryptographic operations (e.g., repeated nonces, identical session keys).
• Use network monitoring to detect anomalies in TLS handshakes (e.g., same client random values).
• Check device logs for power save mode transitions.

Mitigation:

• Disable power save mode if not required.
• Use an external hardware RNG (e.g., ATSHA204A) for critical cryptographic operations.
• Apply firmware patches from Silicon Labs when available.

Indicators of Compromise (IOCs)

• Network: Repeated client random values in TLS ClientHello messages.
• Device: HRNG output showing low entropy (e.g., repeating patterns, values within a narrow range).
• Logs: Frequent transitions to power save mode followed by cryptographic operations.

Detection Engineering

YARA Rule

rule CVE_2026_3290_HRNG_Predictable
{
    meta:
        description = "Detects predictable HRNG output patterns in RS9116 firmware dumps"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-3290"
    strings:
        $hrng_pattern = { 00 00 00 00 01 00 00 00 02 00 00 00 } // Example low-entropy pattern
    condition:
        $hrng_pattern
}

Sigma Rule

title: Predictable HRNG Output from RS9116
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects repeated or low-entropy random numbers generated by RS9116 in power save mode
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "HRNG output: 0x00000000"
        - "HRNG output: 0x00000001"
        - "HRNG output: 0x00000002"
    condition: selection | count() by src_ip > 10
falsepositives:
    - Legitimate low-entropy scenarios (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2026-3290 - Predictable TLS Client Random from RS9116"; flow:to_server; content:"|01 00 00 00|"; offset:11; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Apply firmware updates from Silicon Labs when available.
2. Workaround: Disable power save mode on RS9116 devices if not required.
3. Hardware Mitigation: Use an external hardware RNG (e.g., Infineon OPTIGA) for key generation.
4. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Supply Chain: Verify that new devices use a patched version of the RS9116 firmware.

Valters IT
DevSecOps & Cyber Threat Intelligence