CVE-2026-47147: EmberZNet OTA Server Memory Disclosure Vulnerability

Technical summary

The vulnerability resides in EmberZNet's OTA server request parser, which fails to properly validate malformed OTA packets before processing them. This allows an out-of-bounds read (CWE-125) to occur, where the parser accesses memory regions outside the intended buffer allocation. The disclosed data is constrained by the parser's response mechanism, limiting both the volume and accessibility of leaked information. Exploitation requires the attacker to first establish network membership via the standard Zigbee join procedure, meaning unauthenticated remote attacks from outside the network are not possible. Only endpoints or coordinator devices running the OTA Server cluster implementation are vulnerable.

Business impact

Organizations deploying EmberZNet-based Zigbee devices—including smart home hubs, building automation controllers, and industrial IoT coordinators—face confidentiality risk if an insider or compromised network peer conducts reconnaissance. Memory disclosure can reveal encryption keys, network credentials, or application secrets depending on what resides in RAM at the time of the attack. The risk is most acute in environments with untrusted participants on the same Zigbee network or where network perimeter security is weak. The CVSS score of 7.1 reflects the combination of network reachability and high availability impact against confidentiality.

Affected systems

Silicon Labs EmberZNet version 9.0.2 and all earlier versions are affected. Devices implementing the OTA Server cluster—typically Zigbee coordinators, routers, or dedicated update servers in a Zigbee network—are at risk. Note that not all EmberZNet deployments include OTA Server functionality; devices using EmberZNet only as an end-node or without OTA capabilities are unaffected. Verify your specific device configuration and cluster implementation.

Exploitability

Exploitation is feasible but constrained by two critical prerequisites: the attacker must first successfully authenticate and join the target Zigbee network, and the target device must support the OTA Server cluster. Both conditions significantly reduce the attack surface compared to pre-authentication remote vulnerabilities. No public exploit code exists, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog as of the publication date, indicating no active in-the-wild exploitation has been reported. The attack is entirely within-network and offers no direct path to code execution or network traversal.

Remediation

Silicon Labs should release a patched version of EmberZNet that includes bounds-checking validation for OTA requests prior to parser processing. Pending a vendor patch, organizations should implement network segmentation to isolate Zigbee OTA servers from untrusted devices, disable OTA Server functionality if not required, and enforce strong network access controls to limit which devices can join the Zigbee network. Monitor network logs for malformed OTA requests and evaluate the sensitivity of data that might be stored in the RAM of affected OTA servers.

Patch guidance

Consult the Silicon Labs security advisory for EmberZNet to identify the patched version number and availability. Apply patches to all coordinators and devices running OTA Server functionality as soon as testing confirms compatibility with your deployment. Prioritize devices that store sensitive data in RAM or operate in multi-tenant network environments. Verify patch deployment by confirming the EmberZNet version via device management interfaces.

Detection guidance

Network detection should focus on identifying malformed OTA cluster messages (Zigbee cluster 0x0019) with invalid payload structures, particularly oversized or truncated request frames. Endpoint detection on OTA servers can monitor for memory access anomalies during request parsing or unusual response packet sizes. Log all OTA update transactions and flag requests from devices that have not initiated standard OTA sessions. Behavioral analysis of memory dumps or core files from affected devices may reveal evidence of out-of-bounds reads by inspecting parser state when crashes occur.

Why prioritize this

Although the CVSS score is HIGH (7.1), the practical risk is moderated by strict prerequisites: network authentication is required, and only specific cluster implementations are vulnerable. However, organizations should not deprioritize this work. The confidentiality impact could expose encryption material or credentials, and the availability component (denial of service via memory corruption) could disrupt OTA update processes. Prioritize patching for Zigbee coordinators and OTA servers in security-sensitive environments, then extend to general deployments once patches are verified stable.

Risk score, explained

The CVSS v3.1 score of 7.1 (HIGH) reflects: (1) Network accessibility (AV:N) tempered by the requirement for prior network membership (PR:L), (2) Low attack complexity (AC:L) as malformed requests are straightforward to craft, (3) Confidentiality impact (C:L) from limited memory disclosure, and (4) High availability impact (A:H) from potential out-of-bounds memory access leading to parsing failures or crashes. The score appropriately captures that while remote in network scope, the barrier to entry (joining the network) and limited data leakage prevent a CRITICAL rating.

Frequently asked questions