CVE-2026-47149: EmberZNet Door Lock Denial of Service Vulnerability

Technical summary

CVE-2026-47149 is an out-of-bounds read vulnerability (CWE-125) in the Door Lock cluster implementation of Silicon Labs' EmberZNet stack. When a device receives a Door Lock cluster message containing a user identifier outside the valid range or malformed, the stack attempts to access memory beyond allocated table boundaries. This causes a process termination on the targeted device. The vulnerability requires network adjacency and prior authentication; exploitation does not result in information disclosure to the attacker.

Business impact

Door Lock deployments using EmberZNet are at risk of denial of service through remote crash of lock controllers. In smart home or access control environments, this could render locks unresponsive, disrupting facility access until the device reboots. The impact is primarily operational continuity rather than confidentiality or integrity. Organizations relying on EmberZNet-based door locks should evaluate whether temporary unavailability poses business risk—particularly for critical access points or unattended deployments.

Affected systems

Silicon Labs EmberZNet version 9.0.2 and all earlier versions are affected. Only devices implementing the Door Lock cluster are vulnerable; other EmberZNet deployments are unaffected. Affected customers include door lock manufacturers, smart home integrators, and enterprises deploying Zigbee-based access control using EmberZNet as the protocol stack.

Exploitability

Exploitation requires the attacker to be an authenticated member of the target Zigbee network and capable of sending crafted Door Lock cluster frames to the vulnerable device. This is not a broadcast or unauthenticated attack. The barrier to exploitation is moderate: the attacker needs network access and knowledge of valid device addressing, but the malformed payload itself is trivial to construct. Public exploitation has not been reported.

Remediation

Apply the latest security patch from Silicon Labs. Verify the patch version against the vendor's advisory and thoroughly test in a non-production environment before rolling out to deployed door locks. Until patched, restrict network access to trusted devices and monitor for unusual Door Lock cluster traffic.

Patch guidance

Silicon Labs should publish a patched version addressing the bounds checking in the Door Lock cluster handler. Customers must obtain and verify the specific version number from the official Silicon Labs security advisory or their vendor representative. Given the device-level nature of many door lock implementations, test patches in a staging environment and plan for a controlled rollout to avoid widespread lock unavailability. Check for firmware update mechanisms provided by the lock manufacturer, as the patch may be bundled with a firmware release rather than released as a standalone stack update.

Detection guidance

Monitor network traffic for Door Lock cluster messages (cluster ID 0x0101) with out-of-range user identifier fields directed to vulnerable devices. Log any unexpected process terminations or device resets correlated with Door Lock traffic. Implement alerting on recurring crashes of Door Lock–capable devices. For devices with logging support, enable debug output to capture cluster message details before crashes occur. Correlation of crash events with inbound Zigbee frames is the primary detection method.

Why prioritize this

CVSS 6.5 (Medium) reflects high availability impact but requires authentication and network membership. Prioritize patching for door locks in critical access scenarios or high-availability deployments. Standard office or residential smart locks can be addressed on the next maintenance cycle, but avoid deferring indefinitely. Do not treat this as emergency-level due to authentication requirement.

Risk score, explained

The CVSS 3.1 score of 6.5 assigns high weight to availability impact (A:H) but recognizes that confidentiality and integrity are unaffected (C:N/I:N). The requirement for prior network authentication (PR:L) prevents external unauthenticated attacks. Network-adjacent attack vector (AV:N) and low attack complexity (AC:L) indicate the attacker does not need local access or complex setup, only valid network membership and message crafting capability.

Frequently asked questions