EmberZNet CVE-2026-85079

Exploitation requires an attacker-controlled device that has ALREADY JOINED the target Zigbee network (AV:A adjacent access plus PR:L), so the attacker must already hold valid network membership/credentials - this is not remotely reachable over the internet. The attacker must then WAIT for a victim node to transmit a Simple_Desc_req (a Zigbee service-discovery query) and respond to it with a malformed Simple_Desc_req response; this waiting/timing dependency is the AT:P attack requirement and means the trigger is partially outside the attacker's direct control. Affected software is EmberZNet 9.1.1 and earlier. These factors - prior network admission, adjacency to the Zigbee radio, and dependence on a victim-initiated discovery request - substantially limit realistic exploitation compared with the high technical impact.

This is a legitimately serious memory-safety flaw (CWE-121 stack-based buffer overflow enabling potential RCE) in the EmberZNet Zigbee stack, but several signals temper its real-world urgency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.5 and confirms this is NOT a remote-internet threat: AV:A limits it to the adjacent Zigbee radio network, PR:L means the attacker must already control a device that has joined the network, and AT:P reflects the required precondition that the attacker must wait for the victim to issue a Simple_Desc_req. The vuln.today priority is 'this_week', consistent with a high-impact but precondition-gated bug rather than an emergency. No EPSS score, no CISA KEV listing, and no proof-of-concept are present in the input, so exploitation is: no public exploit identified at time of analysis. The signals are internally consistent - high technical impact (full C/I/A on the vulnerable system, no scope change) balanced against meaningful access and timing requirements - so this is a real priority to patch but not evidence of widespread opportunistic exploitation. MISSING DATA: no EPSS, no KEV status, and no fixed-version string are provided in the input; the Silabs advisory (A-00000589) should be consulted for the patched release.

An attacker first gets a malicious or compromised device admitted onto the target Zigbee network (the PR:L / AV:A precondition), then waits for a legitimate node running EmberZNet 9.1.1 or earlier to send a Simple_Desc_req service-discovery query. The attacker replies with a malformed Simple_Desc_req response that triggers a stack-based out-of-bounds write on the requesting device, potentially achieving remote code execution. No public exploit identified at time of analysis; only the vendor advisory reference is available.