EmberZNet CVE-2026-47148

Exploitation requires the attacker to operate a device that has already successfully joined the target's Zigbee network (PR:L) - an outside/unjoined attacker cannot reach the handler - and the target must be an EmberZNet device that supports the ZCL Groups cluster. The specific trigger is a malformed GetGroupMembership command that induces reads past the end of the message payload. Limiting factors that reduce real-world risk: the mandatory prior network join (so default closed/secured Zigbee networks with install-code provisioning resist external attackers), the requirement that the victim implement the Groups cluster (devices without it are unaffected), and that impact is confined to process termination with no code execution or data disclosure. No user interaction is needed (UI:N).

Signals are internally consistent and point to a moderate, availability-focused issue rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VA:H and VC:N/VI:N/VA:H confirms a network-reachable, low-complexity attack requiring some privilege (the attacker must be a device already joined to the Zigbee network) and yielding availability impact only - no confidentiality or integrity loss. This aligns with the description, which explicitly notes no information leakage was observed back to the sender. No EPSS score, KEV listing, SSVC decision, or POC was provided, so likelihood of opportunistic mass exploitation is low; the PR:L join requirement meaningfully limits the attacker population to devices that have authenticated onto the mesh. Note a conflict in the supplied metadata: the Tags include 'Buffer Overflow' and 'Information Disclosure,' but the CWE is CWE-125 (out-of-bounds read, not overflow) and the description states no data is leaked - treat those tags as imprecise and rely on the CWE and description, which indicate a read-driven crash (DoS) only.

An attacker who controls or compromises a device already joined to the Zigbee network crafts a malformed GetGroupMembership command and sends it to a Groups-cluster-capable EmberZNet target. The over-read past the payload terminates the target's process, taking that node offline; repeating the message sustains the outage. No public exploit code is identified, and the attack requires prior network membership (PR:L) but low complexity once joined.