Which versions of EmberZNet are affected by CVE-2026-47152?

Silicon Labs EmberZNet (Zigbee stack) versions 9.0.2 and earlier contain a denial-of-service vulnerability affecting devices with Level Control cluster support.. A patch is available.

How to fix or mitigate CVE-2026-47152?

Within 24 hours: Inventory all EmberZNet deployments and identify systems running v9.0.2 or earlier with Level Control cluster enabled. Within 7 days: Apply vendor patch from Silicon Labs to all affected systems. Within 30 days: Validate patch deployment across all systems and update asset records.

EmberZNet CVE-2026-47152

Q: What is the CVSS score of CVE-2026-47152?

CVE-2026-47152 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39407 HIGH

Divide By Zero (CWE-369)

2026-06-25 Silabs

GHSA-33vq-frr6-w8mj

Information Disclosure Emberznet Silicon Labs

7.1

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.7 MEDIUM

Zigbee is a local radio mesh so AV:A is more accurate than AV:N; attacker must be a joined network member (PR:L), and impact is availability-only crash (A:H, C/I:N).

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:32 vuln.today

DescriptionCVE.org

In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

AnalysisAI

Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to crash the host process via a malformed Level Control 'Move' command that triggers a divide-by-zero fault. Only deployments where the target device supports the Level Control cluster are affected, and exploitation requires the attacker to be an authenticated member of the Zigbee network (PR:L). No public exploit identified at time of analysis; this is not on CISA KEV.

Technical ContextAI

EmberZNet is Silicon Labs' embedded Zigbee protocol stack used in IoT/smart-home SoCs and gateways, implementing the Zigbee Cluster Library (ZCL). The flaw is in the Level Control cluster command handler, specifically the 'Move' command, which adjusts a device's level at a specified rate. The root cause is CWE-369 (Divide By Zero): a crafted Move command supplies a parameter (e.g. a zero rate) that is used as a divisor without validation, producing a fatal arithmetic fault that terminates the process. Affected CPE is cpe:2.3:a:silicon_labs:emberznet:*:*:*:*:*:*:*:*, covering all versions up to and including 9.0.2.

RemediationAI

Patch available per vendor advisory: upgrade EmberZNet beyond 9.0.2 to the fixed release distributed through the Silicon Labs SiSDK (https://github.com/SiliconLabsSoftware/sisdk-release/) and follow the advisory at https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4; the input does not state an exact fixed version number, so confirm the target build with Silicon Labs before flashing. As compensating controls until devices are reflashed, enforce strict Zigbee network join controls (disable open joining/permit-join, use install codes and link-key authentication) so untrusted devices cannot become network members and reach the Level Control handler; where feasible, segment or limit which nodes can issue Level Control commands. The trade-off is that tightening join policy and command access can disrupt legitimate device onboarding and automation, and for headless embedded targets there is no per-command filtering, so firmware update remains the only complete fix.