Which versions of EmberZNet are affected by CVE-2026-47147?

Silicon Labs EmberZNet Zigbee stack versions 9.0.2 and earlier contain an out-of-bounds read vulnerability in the OTA Server cluster that allows authenticated network devices to leak small amounts of…. A patch is available.

How to fix or mitigate CVE-2026-47147?

Within 24 hours: Inventory all deployed EmberZNet implementations and identify systems running v9.0.2 or earlier with OTA Server cluster enabled. Within 7 days: Apply vendor-released patch to all affected EmberZNet devices; coordinate with device manufacturers if using commercial Zigbee hubs or gateways, as patches may be released through product-specific update channels. Within 30 days: Verify patch deployment across the deployment, review OTA Server access controls to ensure network joining is restricted, and monitor device logs for malformed OTA update requests.

EmberZNet CVE-2026-47147

Q: What is the CVSS score of CVE-2026-47147?

CVE-2026-47147 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39401 HIGH

Out-of-bounds Read (CWE-125)

2026-06-25 Silabs

GHSA-522j-298p-h26w

Buffer Overflow Information Disclosure Emberznet Silicon Labs

7.1

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Reachable over the Zigbee radio (AV:N) but only by a joined device (PR:L); bounded RAM disclosure gives C:L, while parser disruption of the OTA server yields A:H, with no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:30 vuln.today

DescriptionCVE.org

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

AnalysisAI

Out-of-bounds read in the Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device send malformed Over-The-Air (OTA) update requests that drive the OTA Server cluster parser past buffer boundaries, leaking a small, size- and location-limited amount of RAM back to the requester and potentially disrupting the OTA service. Only nodes that implement the OTA Server cluster are affected, and exploitation requires prior network membership (PR:L authenticated). No public exploit is identified and the CVE is not in CISA KEV; the CVSS 4.0 base score of 7.1 is driven mainly by high availability impact (VA:H) rather than data theft.

Technical ContextAI

EmberZNet is Silicon Labs' embedded Zigbee (IEEE 802.15.4) protocol stack, deployed on EFR32/Wireless Gecko SoCs and modules used in coordinators, routers, and smart-home/IoT gateways. The flaw resides in the application-layer OTA Upgrade cluster - specifically the OTA Server role that distributes firmware images to client devices across the mesh. The root cause is CWE-125 (Out-of-bounds Read): the parser handling incoming OTA request fields fails to fully validate length/offset values, so a crafted request causes the server to read memory beyond the intended buffer. Because the disclosed data originates from device RAM and the over-read is bounded in size and location, the confidentiality exposure is constrained, while malformed parsing can also destabilize the OTA server, explaining the high availability metric.

RemediationAI

Upgrade EmberZNet to the Silicon Labs-released build that supersedes 9.0.2 (patch available per vendor advisory; the exact fixed version is not stated in the provided data - confirm the target build via the Silicon Labs advisory at https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1, pull the corrected SiSDK from https://github.com/SiliconLabsSoftware/sisdk-release/, then rebuild and reflash affected coordinator/gateway firmware). Because exploitation requires the OTA Server cluster, an interim compensating control is to disable or not enable the OTA Server cluster on devices that do not need to distribute firmware, which removes the attack surface at the cost of losing local OTA update capability for downstream nodes. Additionally, tighten Zigbee network admission (strong install codes / Trust Center link-key policy, disable open joining/permit-join, and audit the joined-device roster) so only trusted nodes can reach the OTA server; this does not fix the parser but shrinks the attacker pool until firmware is updated.