CVE-2026-66281

Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-66282

Authenticated Denial-of-Service in Zigbee Publish Billing Period

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-85079

Out-of-bounds write in Zigbee Simple_Desc_req handling

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-85080

Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-94502

Out-of-bounds write in Zigbee Publish Price Matrix handling

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-4526

Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47145

Color Control hue/saturation assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47146

Color Control color-temperature assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47147

OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47148

Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47149

Door Lock GetUserType invalid table index in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47150

IAS Zone enroll invalid table index and write in EmberZNet 9.0.2

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47151

Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47152

Level Control Move divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47153

Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet

CVE-2026-47154

Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Silabs Silicon Labs

Products

Emberznet Emberznet