CVE-2026-47151: EmberZNet Door Lock Schedule Memory Corruption Vulnerability

Technical summary

The vulnerability stems from improper bounds checking on ClearWeekdaySchedule message payloads within EmberZNet's Door Lock cluster implementation. When a joined network device transmits a malformed message, the stack writes data beyond allocated buffer boundaries in the schedule state structure. This is classified as CWE-787 (Out-of-bounds Write). The CVSS 3.1 score of 7.1 (HIGH) reflects that while network access and authentication are required, the integrity and availability impacts are significant. The attack surface is limited by the requirement that the attacker must first be an authenticated network participant and target only Door Lock–capable devices.

Business impact

For deployments relying on Zigbee-based smart locks or access control systems built on EmberZNet, this vulnerability poses an operational risk. Affected door locks may experience scheduling failures, preventing legitimate unlock operations or causing locks to remain in unintended states. In critical facilities or multi-tenant buildings, lock unavailability can disrupt access policies and create security gaps. The vulnerability does not enable authentication bypass or lock opening, but rather corrupts the internal scheduling logic—requiring administrative intervention to restore normal operation. Organizations should assess whether any deployed locks depend on weekly schedule functionality and whether network segmentation or device-level access controls mitigate the insider threat vector.

Affected systems

Silicon Labs EmberZNet v9.0.2 and all earlier versions are vulnerable. Impact is limited to devices that implement the Zigbee Door Lock cluster (typically smart locks, electronic deadbolts, and access control devices). Vulnerability requires a successfully joined network device with the ability to send cluster messages. Devices without Door Lock cluster support are unaffected. Organizations should identify which Zigbee devices in their deployments implement this cluster and cross-reference against their EmberZNet stack versions.

Exploitability

Exploitability is moderate and internally constrained. An attacker must already possess network access—either through a compromised Zigbee device on the same PAN, a rogue coordinator, or insider threat. The attacker must understand Zigbee cluster messaging and be able to craft specific payloads targeting the ClearWeekdaySchedule command. Public weaponization is unlikely unless detailed technical analysis surfaces. The authentication requirement (network membership) and cluster-specific targeting significantly reduce the attack surface compared to unauthenticated network-wide exploits. However, in shared or open Zigbee environments, the barrier to entry remains relatively low.

Remediation

Silicon Labs has released patched versions of EmberZNet that correct the bounds checking in Door Lock cluster message handling. Organizations must upgrade to a patched version (verify against the vendor advisory for specific version numbers and release timelines). For deployments unable to patch immediately, consider network segmentation to restrict which devices can send Door Lock commands, enforce Zigbee joining controls, and monitor for unexpected schedule-related failures. Disable unused Door Lock cluster implementations if they are not operationally required.

Patch guidance

Obtain the latest EmberZNet release from Silicon Labs that addresses CVE-2026-47151. Verify the patched version number against the official Silicon Labs security advisory. Test patches in a controlled environment before deploying to production, as Zigbee network changes can affect pairing and device behavior. Coordinate with any third-party manufacturers who may integrate EmberZNet (such as lock vendors) to confirm their product roadmap for vulnerability fixes. Document the patch version and deployment date for compliance and audit purposes.

Detection guidance

Monitor Zigbee network traffic for malformed or unexpected ClearWeekdaySchedule messages targeting Door Lock devices. Watch for logs or telemetry indicating schedule state corruption, failed unlock operations at scheduled times, or unexpected lock behavior that correlates with network activity. Examine device firmware versions to identify which Door Lock devices run vulnerable EmberZNet stacks. Network segmentation allows you to track which devices send cluster commands and to which endpoints. Security information and event management (SIEM) systems can be configured to alert on unusual schedule-related failures if your lock platform exports logs.

Why prioritize this

This vulnerability merits prioritization for any organization running Zigbee-based smart locks or access control systems. The HIGH severity score and the fact that it affects availability of critical physical security functionality justify rapid patching. However, the requirement for network authentication and cluster-specific targeting means it poses less risk than unauthenticated remote code execution vulnerabilities. Prioritize patching of locks in high-security or high-traffic access points (main entrances, server rooms, secure facilities) before less-critical locks. Assess your network topology and whether external attackers could realistically achieve network membership.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is driven by low attack complexity, low privileges required post-authentication, and high availability impact (denial of lock scheduling). The network vector and authentication requirement prevent the score from reaching CRITICAL. Confidentiality is not impacted (no data exfiltration), and integrity is limited to schedule state rather than systemic compromise. For most environments, the actual risk will depend on how critical Door Lock scheduling is to your access control strategy and whether your network boundary includes potential insider threats or easily compromised Zigbee devices.

Frequently asked questions