Which versions of EmberZNet are affected by CVE-2026-47148?

Silicon Labs EmberZNet Zigbee stack versions 9.0.2 and earlier contain a denial-of-service vulnerability in the Groups cluster implementation that allows network-connected devices to crash vulnerable…. A patch is available.

How to fix or mitigate CVE-2026-47148?

24 hours: Inventory all EmberZNet deployments and identify devices running v9.0.2 or earlier that implement the Groups cluster. 7 days: Apply vendor patch to affected devices and validate functionality in non-production environment. 30 days: Complete production rollout of patched versions and verify Groups cluster operations without interruption.

EmberZNet CVE-2026-47148

Q: What is the CVSS score of CVE-2026-47148?

CVE-2026-47148 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39403 HIGH

Out-of-bounds Read (CWE-125)

2026-06-25 Silabs

GHSA-c3rx-2jmc-fr2c

Buffer Overflow Information Disclosure Emberznet Silicon Labs

7.1

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable over Zigbee with low complexity, but attacker must be a joined network device (PR:L); impact is process termination only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:30 vuln.today

DescriptionCVE.org

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.

AnalysisAI

Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to crash a target by sending malformed GetGroupMembership commands, which cause repeated out-of-bounds reads past the message payload and terminate the process. Only devices implementing the Groups cluster are affected, and no information leakage to the sender was observed despite the read primitive. There is no public exploit identified at time of analysis, no CISA KEV listing, and the impact is availability-only (process termination), not code execution or data disclosure.

Technical ContextAI

EmberZNet is Silicon Labs' embedded Zigbee protocol stack used in IoT/mesh radio devices that implement the Zigbee Cluster Library (ZCL). The flaw lives in the handler for the Groups cluster GetGroupMembership command: when the command payload is malformed, the parser reads past the declared end of the message buffer (CWE-125, Out-of-Bounds Read). Rather than returning data, the over-read drives the process into an unrecoverable state and terminates it. Because the vulnerable code path is specific to the Groups cluster, only EmberZNet-based devices that support and enable that cluster expose the affected handler. The affected component per CPE is cpe:2.3:a:silicon_labs:emberznet:*:*:*:*:*:*:*:*, covering all versions through 9.0.2.

RemediationAI

Upgrade EmberZNet to a fixed release beyond 9.0.2 as published in the Silicon Labs SDK; a patch is available per the vendor advisory, but no exact fixed version string was provided in the source data, so confirm the precise patched build against the Silicon Labs advisory (https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1) and the SDK release tags at https://github.com/SiliconLabsSoftware/sisdk-release/ before deployment. Where firmware cannot be updated immediately, reduce exposure by tightening Zigbee network join controls - disable open joining/permit-join and use install-code or link-key provisioning so untrusted devices cannot enter the mesh (trade-off: complicates legitimate device onboarding). If the Groups cluster is not required by the application, disabling or not registering that cluster removes the vulnerable handler (trade-off: breaks group-addressing features such as multicast scene/group control). Monitor for unexpected device resets that could indicate crash attempts.