EUVD-2026-39406
GHSA-f5m5-vmq3-gx5r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable from an already-joined device (PR:L), no user interaction; bounded OOB write yields limited integrity (I:L) and high availability (A:H) impact with no disclosure (C:N).
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
Lifecycle Timeline
1DescriptionCVE.org
In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.
AnalysisAI
Out-of-bounds memory writes in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allow an already-joined network device to corrupt Door Lock schedule state by sending malformed ClearWeekdaySchedule messages. Only devices implementing the Door Lock cluster are affected, and the corruption is bounded in size and location, primarily threatening availability/integrity rather than data disclosure. No public exploit identified at time of analysis; a vendor patch is available.
Technical ContextAI
EmberZNet is Silicon Labs' widely-deployed Zigbee protocol stack used in embedded smart-home and IoT silicon. The flaw lives in the Zigbee Door Lock cluster's scheduling logic: the ClearWeekdaySchedule command is meant to clear weekday access schedules, but malformed message contents are not properly bounds-checked before being written into the schedule state structure, producing an out-of-bounds write (CWE-787, classic memory corruption / buffer overflow). Per the CPE (cpe:2.3:a:silicon_labs:emberznet:*) all builds through 9.0.2 of the stack are in scope, but the vulnerable code path only exists on products that compile in and support the Door Lock cluster.
RemediationAI
Patch available per vendor advisory: update the EmberZNet stack to the fixed release published by Silicon Labs and rebuild/reflash affected Door Lock devices, following the Silicon Labs advisory (https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1) and the patched sources at https://github.com/SiliconLabsSoftware/sisdk-release/. An exact fixed version string was not included in the provided data and should be confirmed from the advisory before deployment. Until firmware can be updated, compensating controls include enforcing strict Zigbee network join policies (disable permit-join, use install codes / link-key provisioning so untrusted devices cannot join), segmenting or removing untrusted devices from networks that contain Door Lock devices, and monitoring for anomalous Door Lock cluster scheduling commands; these reduce the pool of devices able to send the malicious message but do not stop an already-compromised in-network device.
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Re
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows
A malformed packet causes a stack overflow in the Ember ZNet stack. Rated high severity (CVSS 7.5), this vulnerability i
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network devi
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigb
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet (Zigbee stack) versions 9.0.2 and earlier allows an already-joined network d
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Out-of-bounds read in the Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today