Which versions of Silicon Labs EmberZNet are affected by CVE-2026-47153?

Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) contains a denial-of-service vulnerability affecting Level Control cluster nodes; no public exploit has been identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-47153?

Within 24 hours: Complete inventory of Silicon Labs EmberZNet devices in production, identifying all running v9.0.2 or earlier and documenting system criticality. Within 7 days: Obtain patch per vendor advisory, test in staging environment specifically validating Level Control cluster functionality, and confirm compatibility with existing deployments. Within 30 days: Deploy patched firmware to all affected production nodes and verify successful updates across the entire deployment.

Silicon Labs EmberZNet CVE-2026-47153

Q: What is the CVSS score of CVE-2026-47153?

CVE-2026-47153 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39353 HIGH

Divide By Zero (CWE-369)

2026-06-25 Silabs

GHSA-qmrv-48wx-3c53

Information Disclosure Emberznet Silicon Labs

7.1

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Attacker must be a joined network device (PR:L) sending a Zigbee frame (AV:N), trivial to send (AC:L) with no UI; impact is a process crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:33 vuln.today

DescriptionCVE.org

In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.

AnalysisAI

Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigbee network to crash a target node by sending a malformed Level Control 'Step' command that triggers a divide-by-zero (CWE-369) fault and terminates the process. Only nodes implementing the Level Control cluster are affected, and exploitation requires the attacker to already be an authenticated member of the network (CVSS 4.0 PR:L, VA:H). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

EmberZNet is Silicon Labs' widely-embedded Zigbee protocol stack used in IoT and home-automation SoCs, modules, and gateways. The flaw lives in the Zigbee Cluster Library (ZCL) Level Control cluster handler, which processes lighting/dimming commands such as Move, Step, and Move-to-Level. The CWE-369 divide-by-zero indicates the malformed Step command supplies a parameter (for example step size, rate, or transition time) that is used as a divisor without validation, so a zero value causes an arithmetic fault that aborts the stack process. The CPE cpe:2.3:a:silicon_labs:emberznet:*:*:*:*:*:*:*:* covers all EmberZNet application versions up to and including 9.0.2.

RemediationAI

Patch available per vendor advisory: upgrade EmberZNet beyond v9.0.2 using the patched build from the Silicon Labs SiSDK release channel (https://github.com/SiliconLabsSoftware/sisdk-release/) and consult the advisory at https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4 for the exact fixed version, which was not specified in the available data. Where firmware cannot be updated immediately, reduce exposure by tightening Zigbee admission control - enforce install-code or centralized Trust Center link keys and disable open joining so only vetted devices can issue ZCL commands (trade-off: complicates legitimate device onboarding). On nodes that do not need dimming, not registering or disabling the Level Control cluster removes the vulnerable code path (trade-off: loss of brightness/level functionality). Segment and monitor the Zigbee network so a single misbehaving joined node can be identified and removed quickly, since impact is a process crash requiring device restart.