Silicon Labs EmberZNet CVE-2026-47145

Exploitation requires that the attacker's device has already joined the same Zigbee network as the target (PR:L - the join/commissioning step is a hard prerequisite, not optional), and the target must implement and expose the Color Control cluster, so non-lighting/non-color-capable EmberZNet devices are not impacted. The attack needs no user interaction (UI:N) and no special attack requirements (AT:N), and impact is limited strictly to availability (process termination / device crash) with no confidentiality or integrity effect. The principal limiting factors are the prior-network-membership requirement and the Color Control cluster dependency.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VA:H and VC:N/VI:N/SI:N confirms this is a pure availability/denial-of-service issue, not code execution or data exposure - note this contradicts the 'Information Disclosure' tag in the input, and the CVSS metrics (no confidentiality/integrity impact) should be trusted over that tag, which appears mislabeled. PR:L is meaningful: the attacker is not a remote internet attacker but a device that has already joined the Zigbee network, so exploitation presupposes prior network admission (commissioning/join). There is no EPSS score, no POC, and no KEV listing provided, so there is no evidence of active or widespread exploitation; real-world priority is moderate and gated by the trust model of the Zigbee mesh. Realistic risk is highest where untrusted or compromised nodes can join the same network as color-capable devices.

An attacker who controls or compromises a device already commissioned onto the Zigbee network sends a crafted, malformed Color Control command to a color-capable target running vulnerable EmberZNet. The malformed frame trips a reachable assertion in the stack, terminating the process and knocking the device offline until it restarts, and the attack can be repeated to cause sustained outage. No public exploit code is identified, and the network attack vector with low complexity (AC:L) makes the crash trivial to trigger once network access is obtained.