EmberZNet CVE-2026-94502

Two concrete prerequisites apply. First, the malicious messages must originate from a device that has already joined the Zigbee network, i.e. an authenticated/commissioned node (reflected as PR:L and AV:A - adjacent RF, not internet-facing). Second, only devices that implement and support the Smart Energy Price Cluster are affected; devices without Price Cluster support are not impacted. The attack then consists of sending a malformed Publish Price Matrix command. Limiting factors for defenders: the attacker needs prior network membership (possession of the network key / successful commissioning) and local RF proximity, and the target must specifically support the Price Cluster - these conditions meaningfully narrow exposure below that of an internet-reachable unauthenticated RCE. No end-user interaction is required (UI:N).

The input provides a CVSS 4.0 vector of CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (base 7.5, High). The most risk-limiting signals are AV:A (adjacent - this is reachable only over the local Zigbee RF network, not the internet) and PR:L (the attacking device must already be joined/authenticated to the network, as the description confirms). AT:P further indicates a non-trivial attack requirement. Against those limits, the impact signals are maximal: VC:H/VI:H/VA:H, consistent with the described out-of-bounds write potentially leading to remote code execution (CWE-121, stack-based buffer overflow). No EPSS score, no CISA KEV entry, and no PoC or exploit reference are present in the input, so there is no public evidence of active exploitation or available exploit code - this is not a KEV-listed or demonstrably weaponized issue. The vuln.today decision label is 'this_week', consistent with a serious but not emergency priority. Net: a genuine high-impact RCE whose real-world risk is bounded by the need for adjacent RF access and an already-joined device, pointing to targeted/proximate abuse rather than mass remote exploitation. Note the absence of EPSS/KEV/PoC data is a gap, not a confirmation of low likelihood.

An attacker who already controls a device joined to the target Zigbee network (for example a previously commissioned or compromised node) sends a malformed Publish Price Matrix command to a device that supports the Price Cluster. The malformed command triggers an out-of-bounds write that may allow arbitrary code execution on the target. Exploitation requires adjacent RF access and prior network membership; no public exploit code is identified at time of analysis.