Which versions of Silicon Labs EmberZNet are affected by CVE-2026-47154?

Silicon Labs EmberZNet Zigbee stack versions 9.0.2 and earlier contain a remote denial-of-service vulnerability affecting smart metering deployments.. A patch is available.

How to fix or mitigate CVE-2026-47154?

Within 24 hours: Inventory all deployed Silicon Labs EmberZNet devices running v9.0.2 or earlier, prioritizing those implementing Simple Metering clusters. Within 7 days: Apply vendor patch (contact Silicon Labs support or reference product advisory for latest patched version designation). Within 30 days: Complete testing and deployment validation of patched firmware across all affected devices.

Silicon Labs EmberZNet CVE-2026-47154

Q: What is the CVSS score of CVE-2026-47154?

CVE-2026-47154 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39354 HIGH

Out-of-bounds Read (CWE-125)

2026-06-25 Silabs

GHSA-4p3w-7rfw-j47r

Buffer Overflow Information Disclosure Emberznet Silicon Labs

7.1

CVSS 4.0 · Vendor: Silabs

Severity by source

Vendor (Silabs) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Reachable over the Zigbee network (AV:N) with a single low-complexity frame, but requires an already-joined device (PR:L); impact is process crash only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Silabs).

CVSS VectorVendor: Silabs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:32 vuln.today

DescriptionCVE.org

In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.

AnalysisAI

Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device crash the target by sending a malformed Simple Metering GetProfileResponse message that triggers an out-of-bounds read while iterating interval entries, terminating the process. Exploitation requires the attacker to be an authenticated member of the Zigbee network and only affects devices implementing the Simple Metering cluster. No public exploit identified at time of analysis, and no information leakage back to the sender was observed.

Technical ContextAI

EmberZNet is Silicon Labs' widely-embedded Zigbee protocol stack used in smart metering and IoT mesh devices. The flaw lives in the handling of the Simple Metering cluster's GetProfileResponse command, which carries a count of profile interval entries followed by the entry data. The root cause is CWE-125 (Out-of-Bounds Read): the parser iterates over interval entries based on an attacker-influenced count/length without correctly bounding the read against the actual payload size, causing it to read past the buffer and crash. Per the CPE, the affected product is cpe:2.3:a:silicon_labs:emberznet across versions, scoped specifically to firmware that supports the Simple Metering (metering) cluster.

RemediationAI

Patch available per vendor advisory: upgrade EmberZNet beyond the affected 9.0.2-and-earlier line using the fixed release distributed through Silicon Labs (advisory: https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1; source/release tracking: https://github.com/SiliconLabsSoftware/sisdk-release/) - an exact fixed version number was not stated in the available data, so confirm the target build with Silicon Labs before deploying firmware to fielded devices. Where immediate firmware update is impractical, compensating controls include disabling or not provisioning the Simple Metering cluster on devices that do not require it (trade-off: breaks metering/profile reporting functionality), and tightening Zigbee network admission so only trusted, vetted devices can join and obtain the network key (trade-off: increased commissioning friction), since exploitation requires an already-joined device. Monitor affected nodes for unexpected resets/process termination as a detection signal.