EmberZNet CVE-2026-66281

Two concrete prerequisites must both hold: (1) the attacker must operate a device that has ALREADY JOINED the Zigbee network (authenticated participant, matching PR:L) - this is not reachable by an off-network or internet-based attacker; and (2) the TARGET device must support manufacturer-specific clusters, since only those devices process the vulnerable Discover Attributes path (matching AT:P). Devices without manufacturer-specific cluster support are not impacted. Limiting factors for defenders: prior network membership is required, impact is availability-only (device hang/DoS) with no data exposure or code execution, and no user interaction is needed once the two conditions are met. The exact triggering byte structure of the malformed command is not described in the available sources.

This is a moderate-severity availability issue (CVSS 4.0 base 6.0) rather than a critical priority. The vendor-supplied vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N shows a pure denial-of-service impact (VA:H, with VC:N and VI:N - no confidentiality or integrity effect), gated by two meaningful preconditions: PR:L means the attacker must already be an authenticated/joined participant on the Zigbee network, and AT:P reflects a specific attack requirement (the target must support manufacturer-specific clusters). No EPSS score was supplied, the CVE is not on CISA KEV, and no proof-of-concept or exploit reference is present in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' consistent with a vendor-driven, patch-this-cycle priority rather than act_now/emergency. One caveat on signal interpretation: the vector is AV:N, but EmberZNet is a Zigbee embedded stack, so 'network' here means the local Zigbee RF network reachable only by an already-joined device, not the open internet - this materially narrows the real attacker population versus what AV:N alone might suggest. Net: a legitimate issue to remediate on the vendor's recommended timeline, but the authentication requirement, the manufacturer-specific-cluster precondition, and availability-only impact keep real-world risk below what a 6.0 might imply for an internet-facing service.

An attacker who already controls or has compromised a device joined to the Zigbee network sends a malformed Discover Attributes command to a neighboring device that supports manufacturer-specific clusters. The malformed message drives the target's cluster-handling code into a loop with an unreachable exit condition (CWE-835), hanging the device and denying service. No public exploit code is identified at time of analysis.