CVE-2026-47146: EmberZNet Color Control Denial of Service (CVSS 6.5)

Technical summary

This vulnerability stems from insufficient input validation on Color Control cluster messages in EmberZNet. When a joined device sends a malformed Color Control message, the EmberZNet stack encounters an unhandled assertion that terminates the process. The CWE-617 classification (Reachable Assertion) indicates that the code path is reachable from an attacker position without special conditions beyond network membership. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects network-accessible attack vector, low attack complexity, and requirement for prior authentication as a network member, with availability impact as the sole consequence.

Business impact

The primary impact is operational disruption. An authenticated network member can repeatedly crash EmberZNet devices supporting Color Control, causing service outages and potential cascading failures in mesh deployments where a coordinator or critical relay node is affected. In industrial IoT, lighting control systems, or smart home hubs relying on EmberZNet, this could disrupt automation, monitoring, or critical control functions. No data confidentiality or integrity is compromised—the risk is confined to availability.

Affected systems

All deployments running Silicon Labs EmberZNet version 9.0.2 or earlier are in scope. Specifically vulnerable are devices that include the Color Control cluster implementation. EmberZNet is used in Zigbee-based IoT products, including industrial controllers, smart lighting, HVAC systems, and mesh-based home automation platforms. The vulnerability only manifests if the attacking device has completed Zigbee network join procedures, limiting exposure to insider or previously-compromised network members.

Exploitability

Exploitability is moderate. An attacker must already be part of the Zigbee network—a significant barrier for external threats but a real concern for insider scenarios or compromised devices. Once on the network, attack complexity is low: crafting a malformed Color Control message is straightforward. The attack is repeatable and requires no user interaction. The vulnerability is not listed on the CISA KEV catalog, suggesting it has not yet been observed in active exploit campaigns, though that status can change.

Remediation

Update EmberZNet to a version containing the fix—verify the specific patched version in Silicon Labs' advisory. Since the vulnerability requires prior network membership, segregating Zigbee networks by trust domain or device class may reduce exposure in the interim. Consider disabling Color Control cluster on devices that do not require it. Monitor EmberZNet logs for unexpected process terminations or assertions related to Color Control message handling.

Patch guidance

Contact Silicon Labs or consult their security advisories to identify the minimum version that resolves CVE-2026-47146. Typically, a patched maintenance release (e.g., 9.0.3 or later) will be issued. Validate patch availability for your specific EmberZNet distribution channel and device firmware mechanism. Test patches in a non-production environment first, as EmberZNet deployments often involve mesh-critical devices where updates must be coordinated carefully. Verify that patched devices can rejoin the network without affecting mesh stability.

Detection guidance

Monitor EmberZNet process logs and system logs for assertion failures or unexpected terminations correlated with Color Control cluster activity. Network-level detection is difficult without packet analysis, but tools that parse Zigbee frames can be configured to alert on malformed Color Control messages from known joined devices. Implement alerting on EmberZNet process crashes; a spike in crashes on devices supporting Color Control may indicate attack activity. Establish baseline process stability metrics to identify anomalies.

Why prioritize this

This vulnerability warrants medium priority patching. The requirement for prior network membership significantly reduces the attack surface compared to unauthenticated remote exploits. However, if your deployment includes untrusted or guest Zigbee devices, or if your network has been compromised, the risk rises. Prioritize patching for mesh coordinators and critical relay nodes, as their disruption has broader impact. Deployments with strong network segmentation and access control can safely schedule patches in the normal maintenance window; others should accelerate.

Risk score, explained

The CVSS 6.5 score balances moderate severity with constrained exploitability. Availability impact is high (the process crashes), but the attack requires network membership (PR:L) and cannot affect confidentiality or integrity. Attack complexity is low, and the attack is repeatable without user interaction. The score accurately reflects a denial-of-service risk that is serious in operational contexts but not critical for most organizations because exploitation hinges on an attacker already being part of the network infrastructure.

Frequently asked questions