CVE-2026-47148: EmberZNet Groups Cluster Denial of Service Vulnerability

Technical summary

CVE-2026-47148 is a buffer over-read flaw (CWE-125) in EmberZNet's Groups cluster command handling. When a device receives a GetGroupMembership command with a malformed payload, the parser reads beyond the actual message boundary, leading to uncontrolled memory access and process termination. The vulnerability requires the attacker's device to have already completed the network join process, limiting the attack surface to authenticated participants. No information disclosure was observed during analysis, making this primarily an availability issue.

Business impact

Organizations deploying EmberZNet-based mesh networks—commonly found in smart home, industrial IoT, and building automation systems—face potential service disruptions. An attacker already present on the network can selectively disable devices supporting the Groups cluster, fragmenting network topology and interrupting automation workflows. Recovery requires manual device restart or network remediation, introducing operational downtime and administrative overhead.

Affected systems

Silicon Labs EmberZNet version 9.0.2 and all earlier versions are vulnerable. The impact is limited to devices that have the Groups cluster enabled; devices without this cluster are unaffected. EmberZNet is widely used in Zigbee-based solutions for home and industrial automation.

Exploitability

Exploitation requires network-level access and prior successful device enrollment on the target network. An attacker cannot remotely join a closed network to launch this attack; they must either be a legitimate member already or gain access through network compromise elsewhere. Once positioned, crafting the malformed command is straightforward. The CVSS score of 6.5 (Medium) reflects the moderate attack complexity combined with high availability impact and the prerequisite of network membership.

Remediation

Silicon Labs has addressed this issue in EmberZNet versions after 9.0.2; verify the specific patched version in the official Silicon Labs security advisory. Organizations should upgrade to the latest stable release that includes this fix. For devices that cannot be immediately patched, network segmentation and access controls can reduce exposure by limiting which devices can join the mesh.

Patch guidance

Review Silicon Labs' official product security page and EmberZNet release notes to identify the minimum patched version for your deployment. Upgrade affected devices in a staged rollout to prevent network-wide disruption. Firmware updates for EmberZNet devices may require physical access or specific bootloader sequences; consult your device manufacturer's update procedure. After patching, verify that Groups cluster functionality is still operational in your automation workflows.

Detection guidance

Monitor for unexpected device disconnections or repeated restart cycles among EmberZNet devices, particularly those with Groups cluster enabled. Network-level detection is challenging because the malformed GetGroupMembership command appears as standard Zigbee traffic; focus on behavioral anomalies such as sudden loss of devices and rapid reconnection attempts. Capture Zigbee frames in suspicious windows and correlate with device log entries showing buffer-related faults or stack traces.

Why prioritize this

This vulnerability merits prompt attention for organizations running critical EmberZNet infrastructure, but it is not an emergency requiring emergency patching across the estate. The requirement for prior network enrollment significantly limits blast radius compared to unauthenticated remote exploits. Prioritize patching devices in high-availability environments (lighting systems, HVAC controls) and those exposed to untrusted network participants. Less critical systems can be updated within the next regular maintenance window.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a straightforward network-based attack (AV:N) with low attack complexity (AC:L), requiring authenticated network participation (PR:L), no user interaction (UI:N), single scope (S:U), and no confidentiality or integrity impact (C:N/I:N) but high availability impact (A:H). The score appropriately balances the ease of exploitation once an attacker is on the network against the prerequisite of prior enrollment and the absence of data exposure.

Frequently asked questions