EUVD-2026-39353
GHSA-qmrv-48wx-3c53
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin target Zigbee network as device
-
DeliveryCraft malformed Level Control Step command
-
ExploitSend to node supporting Level Control cluster
-
ExecutionTrigger divide-by-zero in ZCL handler
-
ImpactProcess terminates, device offline
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Division safety checks
|
| Exploitation Conditions | Exploitation requires (1) the attacker to control a device that has ALREADY successfully joined the target's Zigbee network (CVSS PR:L - not an outside or unauthenticated attacker), and (2) the target device to implement the Zigbee Level Control cluster; devices without that cluster are not impacted. The specific trigger is a malformed Level Control 'Step' command whose parameters induce a divide-by-zero. Limiting factors: network membership/join is mandatory, the vulnerable cluster must be present and enabled, and impact is confined to availability (process crash) with no code execution or data exposure. Affected scope is EmberZNet v9.0.2 and earlier only. |
| Impact | This is a genuine but bounded availability risk. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:N/VI:N/VA:H, base 7.1) correctly captures a pure denial of service: no confidentiality or integrity impact, only process termination. The decisive limiter is PR:L - the malicious frame must originate from a device that has already joined the Zigbee network, so a successful network join or pre-existing trust relationship is a prerequisite, which substantially narrows the attacker population versus a truly unauthenticated remote bug. No EPSS score, no KEV listing, and no POC are present in the provided data, so real-world exploitation pressure appears low and would be insider/opportunistic rather than mass-scanned. One conflict to flag explicitly: the input Tags label this 'Information Disclosure,' but the description, CWE-369, and the VA:H/VC:N/VI:N vector all indicate denial of service, not disclosure - treat the tag as mislabeled and the DoS characterization as authoritative. |
| Exploit ScenarioDerived | An attacker who already controls a device joined to the Zigbee network - for example a compromised or rogue end node - crafts a malformed Level Control 'Step' command with a parameter that forces a divide-by-zero and sends it to a target node supporting the Level Control cluster. The target's EmberZNet process faults and terminates, dropping the device offline until it is restarted. With AC:L and no user interaction, the frame can be replayed for sustained outage; no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigbee network to crash a target node by sending a malformed Level Control 'Step' command that triggers a divide-by-zero (CWE-369) fault and terminates the process. Only nodes implementing the Level Control cluster are affected, and exploitation requires the attacker to already be an authenticated member of the network (CVSS 4.0 PR:L, VA:H). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade EmberZNet beyond v9.0.2 using the patched build from the Silicon Labs SiSDK release channel (https://github.com/SiliconLabsSoftware/sisdk-release/) and consult the advisory at https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4 for the exact fixed version, which was not specified in the available data. Where firmware cannot be updated immediately, reduce exposure by tightening Zigbee admission control - enforce install-code or centralized Trust Center link keys and disable open joining so only vetted devices can issue ZCL commands (trade-off: complicates legitimate device onboarding). On nodes that do not need dimming, not registering or disabling the Level Control cluster removes the vulnerable code path (trade-off: loss of brightness/level functionality). Segment and monitor the Zigbee network so a single misbehaving joined node can be identified and removed quickly, since impact is a process crash requiring device restart.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EmberZNet is Silicon Labs' widely-embedded Zigbee protocol stack used in IoT and home-automation SoCs, modules, and gateways. The flaw lives in the Zigbee Cluster Library (ZCL) Level Control cluster handler, which processes lighting/dimming commands such as Move, Step, and Move-to-Level. The CWE-369 divide-by-zero indicates the malformed Step command supplies a parameter (for example step size, rate, or transition time) that is used as a divisor without validation, so a zero value causes an arithmetic fault that aborts the stack process. The CPE cpe:2.3:a:silicon_labs:emberznet:*:*:*:*:*:*:*:* covers all EmberZNet application versions up to and including 9.0.2.
Know when Emberznet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker must be a joined network device (PR:L) sending a Zigbee frame (AV:N), trivial to send (AC:L) with no UI; impact is a process crash only, so C:N/I:N/A:H.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
DescriptionCVE.org
In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.
Executive ViewAI
Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) contains a denial-of-service vulnerability affecting Level Control cluster nodes; no public exploit has been identified at time of analysis. Authenticated network members could trigger node crashes, potentially disrupting IoT and industrial automation operations through internal threats or compromised devices. Organizations with production Zigbee deployments should prioritize patch deployment to restore network stability and prevent operational disruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Re
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows
Stack-based out-of-bounds write in Silicon Labs EmberZNet 9.1.1 and earlier lets a device that has already joined a Zigb
Out-of-bounds write in Silicon Labs EmberZNet 9.1.1 and earlier allows a Zigbee node that has already joined the network
A malformed packet causes a stack overflow in the Ember ZNet stack. Rated high severity (CVSS 7.5), this vulnerability i
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network devi
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined Zigbee device to
Exploit-DB