EUVD-2026-39405
GHSA-w2c5-vjq8-v8hc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because the attacker must already be a joined network device; A:H for process termination, I:L for the constrained out-of-bounds write, C:N as no data disclosure occurs.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
Lifecycle Timeline
1DescriptionCVE.org
In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.
AnalysisAI
Denial of service in Silicon Labs EmberZNet (Zigbee stack) versions 9.0.2 and earlier allows an already-joined network device to crash the host process by sending malformed IAS Zone enrollment messages, which trigger an out-of-bounds write to the state table. Only nodes that support the IAS Zone (security sensor) cluster are affected, and the attacker must already hold a valid place on the Zigbee network (PR:L). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
EmberZNet is Silicon Labs' widely-embedded Zigbee protocol stack that runs on EFR32/Wireless Gecko SoCs and NCP coprocessors, implementing the Zigbee Cluster Library including the IAS (Intruder Alarm System) Zone cluster used by security sensors such as door/window contacts, motion detectors and smoke alarms. The flaw is a CWE-787 out-of-bounds write: when processing IAS Zone enrollment messages, malformed input drives a write past the bounds of an internal state table. Per the advisory the size and target of the corrupting write are constrained, which limits it to a process-terminating fault (denial of service) rather than reliable code execution, consistent with the CVSS integrity-low / availability-high impact split.
RemediationAI
Patch available per vendor advisory: upgrade EmberZNet to a fixed release beyond 9.0.2 obtained from the Silicon Labs SiSDK release channel (https://github.com/SiliconLabsSoftware/sisdk-release/) and review the advisory at the Silicon Labs portal for the exact corrected version, then rebuild and reflash affected SoC/NCP firmware - an exact fixed version string was not provided in the input and should be confirmed from the advisory before deployment. Where immediate firmware update is impractical, reduce exposure by tightening network admission (use install codes / centralized Trust Center link keys so rogue devices cannot join), removing or disabling the IAS Zone cluster on devices that do not need it (trade-off: breaks legitimate security-sensor enrollment), and monitoring for repeated malformed enrollment traffic or unexpected node resets so a crashing/spoofed device can be quarantined and re-keyed.
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Re
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows
A malformed packet causes a stack overflow in the Ember ZNet stack. Rated high severity (CVSS 7.5), this vulnerability i
Remote denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network devi
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows a device already joined to the Zigb
Denial of service in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allows an already-joined network device to
Out-of-bounds memory writes in Silicon Labs EmberZNet (Zigbee stack) v9.0.2 and earlier allow an already-joined network
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Out-of-bounds read in the Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) lets an already-joined network device cras
Denial of service in Silicon Labs EmberZNet Zigbee stack (v9.0.2 and earlier) allows an already-joined network device to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today