CVE-2026-107359

Malformed Wi-Fi Beacon Causes Crash on WF200

Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Wf200

CVE-2026-66281

Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-66282

Authenticated Denial-of-Service in Zigbee Publish Billing Period

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-85079

Out-of-bounds write in Zigbee Simple_Desc_req handling

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-85080

Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-94502

Out-of-bounds write in Zigbee Publish Price Matrix handling

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-66279

Dis-connect vulnerability in Connect Stack

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Connect Sdk

CVE-2026-89410

Out-of-bounds read in Z-Wave NCP SPI Handler

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Z-wave Sdk

CVE-2026-89409

Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​

In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs

Products

Z-wave Sdk

CVE-2026-4526

Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47145

Color Control hue/saturation assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47146

Color Control color-temperature assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47147

OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47148

Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47149

Door Lock GetUserType invalid table index in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47150

IAS Zone enroll invalid table index and write in EmberZNet 9.0.2

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47151

Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47152

Level Control Move divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47153

Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47154

Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet