EUVD-2026-108182
GHSA-pmf2-p6v3-p6jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCommission/compromise device onto Zigbee network
-
ExploitSend malformed Publish Billing Period command
-
ExecutionTrigger uncontrolled recursion in Price Cluster handler
-
ImpactCrash or hang target node (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitation requires an attacker-controlled device that has already joined (been commissioned onto) the same Zigbee network as the target, and the target must be running EmberZNet 9.1.1 or earlier with Price Cluster support present; devices that do not support the Price Cluster are not impacted. It cannot be triggered by an external or unjoined device, and no user interaction is required. The limiting factors are therefore network membership (PR:L) and the Price-Cluster-support requirement (reflected as AT:P), which together confine exploitation to insiders or already-compromised nodes within the mesh rather than arbitrary remote attackers. |
| Impact | This is a medium-severity denial-of-service issue, not a high-priority emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 6.0) shows availability-only impact (VA:H) with no confidentiality or integrity effect - consistent with CWE-674 uncontrolled recursion that exhausts the stack and hangs/crashes the device. Two signals materially constrain real-world risk: PR:L and the explicit requirement that the malicious message originate from a device that has already joined the Zigbee network, so an unjoined/external attacker cannot reach it; and AT:P plus the description's statement that only devices supporting the Price Cluster are affected, further narrowing the exploitable population. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with a patch-on-normal-cadence posture. Note a data conflict: the input Tags label this 'Information Disclosure', but the CVSS vector (VC:N/VI:N/VA:H) and the recursion mechanism make this a pure availability/DoS issue - the disclosure tag is incorrect and should not drive triage. |
| Exploit ScenarioDerived | An attacker who has already commissioned a malicious or compromised node onto the target Zigbee network sends a malformed Publish Billing Period (Price Cluster) command to a node running EmberZNet 9.1.1 or earlier that supports the Price Cluster. The malformed command drives an unbounded recursive function call (CWE-674) that never reaches its end condition, exhausting the stack and crashing or hanging the target device. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Uncontrolled recursion in Silicon Labs EmberZNet 9.1.1 and earlier allows a device that has already joined the same Zigbee mesh to crash or hang a target node by sending a malformed Price Cluster Publish Billing Period command, producing a high availability impact with no confidentiality or integrity effect. Exposure is narrow by design: only nodes that implement the Price Cluster are affected, and the triggering frame must originate from an already-commissioned device on the same network, so the PR:L metric reflects network membership rather than arbitrary remote reach. The issue is not listed in CISA KEV and no public exploit was identified at time of analysis; the priority signal places it in the current month's remediation queue rather than emergency patching.
RemediationAI
The primary fix is a firmware update to an EmberZNet SDK release later than 9.1.1 as directed by Silicon Labs advisory A-00000590 (https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.md); no exact fixed version number is present in the supplied data, so confirm the target release in the advisory before rolling out, and plan the update for the current remediation cycle given the medium severity and availability-only impact. For devices that do not need energy-pricing functionality, excluding the Price Cluster from the endpoint's simple descriptor removes the affected command handler entirely, at the cost of losing billing/pricing features and requiring a re-commission or firmware rebuild rather than a config tweak. Because the trigger must come from a device already joined to the mesh, tightening commissioning controls - rotating and protecting the network key, using install codes, and monitoring for nodes that flood Price Cluster traffic or repeatedly reset peers - limits who can reach the vulnerable handler, though it does not fix the recursion itself and adds provisioning overhead. Devices without Price Cluster support require no action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EmberZNet is Silicon Labs' Zigbee PRO protocol stack and SDK for SoC and NCP designs, and the affected functionality sits in its Zigbee Cluster Library implementation of the Price Cluster used in smart-energy deployments. A malformed Publish Billing Period command - a server-to-client Price Cluster command normally emitted by a metering/pricing server - drives the command-handling code into a recursive call path that never satisfies its end condition, the classic CWE-674 uncontrolled-recursion pattern that terminates in stack exhaustion, a watchdog reset, or an unresponsive node. The CVSS 4.0 vector supplied by the vendor (AV:N/AC:L/AT:P/PR:L/UI:N/VA:H) and the independent CVSS 3.1 assessment (AV:N/AC:H/PR:L/UI:N/A:H) agree on the substance: network-reachable, low-privilege, no user interaction, availability-only. The AT:P / AC:H element is the deployment condition that the target actually implements Price Cluster support; the exploit does not require specialist timing or grooming, only mesh membership and a Price-Cluster-bearing endpoint. The accompanying tag reads "Information Disclosure" while both vectors show C:N/I:N, so that tag should be treated as a labeling artifact rather than a real confidentiality impact.
Know when Emberznet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker must be a joined low-privilege node (PR:L) and the target must support the Price Cluster (modeled as AC:H); impact is crash-only, so C:N/I:N/A:H.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
DescriptionCVE.org
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Re
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows
Stack-based out-of-bounds write in Silicon Labs EmberZNet 9.1.1 and earlier lets a device that has already joined a Zigb
Out-of-bounds write in Silicon Labs EmberZNet 9.1.1 and earlier allows a Zigbee node that has already joined the network
A malformed packet causes a stack overflow in the Ember ZNet stack. Rated high severity (CVSS 7.5), this vulnerability i
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network devi
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigb
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Exploit-DB