Wi-SUN protocol security: the CVE record behind smart grid mesh networks

Wi-SUN (Wireless Smart Ubiquitous Network) is a mesh networking technology standardized by the Wi-SUN Alliance on top of IEEE 802.15.4-SUN. Its flagship profile, Wi-SUN FAN (Field Area Network), has — per the Alliance's own site — been recognized as international standard ISO/IEC/IEEE 32857:2026, which the Alliance describes as "the first wireless mesh network standard adopted by ISO/IEC." The Alliance names smart utilities (electricity, gas and water metering and distribution management) and smart cities (lighting, agriculture) as Wi-SUN's primary application areas, which is why it sits underneath a large share of the advanced metering infrastructure (AMI) deployed by electric, gas and water utilities today — the same class of field-deployed, hard-to-physically-reach infrastructure that makes any mesh-wide protocol flaw expensive to remediate.

For device identity, the Wi-SUN Alliance's own cyber security certificates page describes a PKI model: "Wi-SUN FAN devices [must] contain device identity certificates issued from either a Wi-SUN Alliance third party certificate authority or a manufacturer certificate authority," naming WISeKEY, OmniTrust and GlobalSign as the three authorized providers of IDevID (Initial Device Identity) and LDevID (Locally Significant Device Identity) certificates. The same page is explicit about a limitation worth noting: "Wi-SUN Alliance does not provide a policy and procedure for PKI evaluation or auditing of certificate authorities" — the detailed security procedures live in a members-only "FAN Public Key Infrastructure Policy and Procedure" document, not in public view.

NVD's record for CVE-2023-1261 describes "missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier" that "allows malicious node to route malicious messages through network" — CWE-862 (Missing Authorization), CVSS v3.1 base score 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). The affected range spans Silicon Labs Wi-SUN SDK versions 1.0.0 through 1.5.0. NVD's companion record for CVE-2023-1262, published the same day, describes the identical root cause in a different component: "Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages through network" — also CWE-862, with a primary CVSS v3.1 score of 5.3 and a secondary score of 8.2 matching the SDK finding's full-impact vector.

A missing MAC-layer authorization check means the mesh's own routing layer does not verify that a node is entitled to inject or forward a given message before acting on it — the practical effect NVD describes is a malicious node routing forged messages through the rest of the network. Because the flaw lives in the SDK and border router, not a single manufacturer's firmware customization, it affects every device built on the unpatched reference stack versions, not one product line.

It is a separate, and in some ways more fundamental, problem. NVD's record for CVE-2025-7448, published 12 September 2025, describes "Wi-SUN unexpected 4-Way Handshake packet receptions" that "may lead to predictable keys and potentially leading to Man in the middle (MitM) attack" — CWE-290 (Authentication Bypass by Spoofing), CVSS v4.0 base score 8.6 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/...). Where the 2023 CVEs concern authorization of messages already inside the mesh, CVE-2025-7448 concerns the handshake that establishes the session keys protecting those messages in the first place. If an attacker can force the handshake into an unexpected packet sequence and predict the resulting key, the encryption protecting the rest of the mesh's traffic is compromised at the root, independent of how well any individual node enforces MAC-layer authorization.