EUVD-2026-108180
GHSA-2j8f-gm3f-3335
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessOperate a device already joined to the Zigbee network
-
ExploitSend malformed GetGroupMembership to Group Cluster device
-
ExecutionTrigger out-of-bounds stack write
-
ImpactCrash target device (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker-controlled device that has already joined the target Zigbee network (PR:L), and the victim device must support the Group Cluster - devices without that cluster are not impacted. The attacker then sends a malformed GetGroupMembership message to trigger the out-of-bounds stack write. Limiting factors that reduce real-world risk: prior network membership is mandatory (no unauthenticated outsider access), the attack surface is restricted to Group Cluster-supporting devices, and impact is limited to a crash - only a limited number of values can be written and no code execution was observed. Affected software is EmberZNet 9.1.1 and earlier. |
| Impact | This is a medium-severity denial-of-service issue, not a high-impact priority. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 6.0) shows impact confined to availability (VA:H) with no confidentiality or integrity effect, consistent with the description stating only a crash and explicitly no observed route to remote code execution. PR:L and AT:P are the key limiters: the attacker must operate a device that has already joined the Zigbee network and the target must support the Group Cluster. No EPSS score was provided in the input, there is no CISA KEV listing, and no public PoC or exploit reference is present (the only reference is the Silicon Labs vendor advisory). The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with a DoS-only flaw gated behind prior network membership. Net: a real but contained bug - prioritize patching on the normal cycle, not as an emergency. One caveat to verify with the vendor: AV:N is used, yet Zigbee is a short-range radio mesh requiring an already-joined device, so adjacency/proximity constraints apply in practice even though the metric reads 'network'. |
| Exploit ScenarioDerived | An attacker who already controls or has compromised a device joined to the target Zigbee network sends a malformed GetGroupMembership message to a device that supports the Group Cluster. The malformed message triggers an out-of-bounds stack write that crashes the target device, causing a denial of service. No public exploit code is available, and only a limited number of values can be written, so code execution was not observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Silicon Labs EmberZNet 9.1.1 and earlier crashes when a device that is already a member of the Zigbee network sends a malformed GetGroupMembership message to a node that implements the Group Cluster, because the request is handled without sufficient bounds checking on a stack buffer (CWE-121). Only a limited number of values can be written and no route to remote code execution was observed, so the practical outcome is a denial of service against the affected node rather than takeover. The CVSS 4.0 vector requires low privileges (PR:L) and prior network presence, the affected software is a constrained embedded stack, and no public exploit has been identified at time of analysis; this is a medium-severity availability issue rather than a high-impact priority, and the vendor-reported decision label places remediation in the current monthly cycle.
RemediationAI
The available data does not identify a specific fixed release version; the advisory at https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.md is the authoritative source for the patched EmberZNet release, and installations at 9.1.1 or earlier should be upgraded to the version that advisory names once confirmed. Because exploitation requires a device that has already joined the network and is limited to Group Cluster-supporting nodes, the interim exposure reduction described by the evidence is commissioning discipline: restrict which nodes may join and retain network keys, and remove or re-key untrusted nodes, since an outsider that cannot join cannot deliver the malformed GetGroupMembership frame - the trade-off is operational overhead in join/commissioning control and loss of the ability to onboard third-party devices casually. Deploying builds without the Group Cluster on nodes that do not need group addressing removes the vulnerable handler entirely, at the cost of group membership and scene/group-based automation features. The result of a successful hit is a crash of the affected node, so availability monitoring and watchdog-based recovery limit outage duration but do not prevent the trigger.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EmberZNet is Silicon Labs' Zigbee PRO protocol stack for 802.15.4 mesh SoCs and modules, and the vulnerable path is the Group Cluster (the Zigbee Cluster Library group-management functionality) that tracks which groups a node belongs to. A GetGroupMembership request enumerates group membership and is normally answered from a fixed-size stack structure; the advisory states that a malformed instance of this message produces an out-of-bounds stack write, which is CWE-121 (stack-based buffer overflow) and manifests as an assertion/crash of the node. The advisory is explicit about the limits of the primitive: only a limited number of values can be written through this flaw, and no route to remote code execution was observed, so third-party tagging that labels the item as RCE or generic stack overflow overstates what the vendor documented. Exploitation prerequisites are significant and are reflected in the assessed vector: the CVSS 4.0 score marks AT:P because a specific prior condition must hold (an attacker-controlled device must already have joined the target network), and AC:L with PR:L and UI:N mean the crafted frame is sent without user interaction by a low-privileged network member. The trigger is delivered over the air as a normal cluster command, so the attack surface is confined to nodes that both implement the Group Cluster and are reachable from an already-commissioned node; the sources do not describe the exact parsing path or the specific field that overflows, so the precise malformed byte layout is not public at time of analysis.
Know when Emberznet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Requires a device already joined to the Zigbee network so PR:L; impact is a crash only, hence A:H with C:N/I:N and no scope change.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
DescriptionCVE.org
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Re
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows
Stack-based out-of-bounds write in Silicon Labs EmberZNet 9.1.1 and earlier lets a device that has already joined a Zigb
Out-of-bounds write in Silicon Labs EmberZNet 9.1.1 and earlier allows a Zigbee node that has already joined the network
A malformed packet causes a stack overflow in the Ember ZNet stack. Rated high severity (CVSS 7.5), this vulnerability i
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network devi
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigb
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Exploit-DB