CVE-2026-47152: EmberZNet Level Control DoS Vulnerability

Technical summary

This vulnerability is a divide-by-zero fault (CWE-369) in the Level Control cluster's Move command handler within EmberZNet v9.0.2 and earlier. The flaw occurs when the command parsing logic fails to validate input parameters before performing arithmetic operations, allowing a malicious denominator value of zero. Because the attack requires the attacker to first join the Zigbee network as an authenticated device, the threat model assumes either network compromise or insider access. Only devices with Level Control cluster support are vulnerable; the fault does not affect devices lacking this cluster implementation.

Business impact

Organizations deploying EmberZNet-based Zigbee networks for IoT or smart home applications face service disruption. A threat actor who has compromised or spoofed a network-joined device can remotely crash connected endpoints, leading to loss of control over lighting, HVAC, industrial sensors, or other Level Control-dependent systems. For industrial IoT deployments, this can impact operational continuity. The attack does not expose data or enable lateral movement, but repeated crashes degrade availability and could be used as a cover for other malicious activity.

Affected systems

Silicon Labs EmberZNet v9.0.2 and all earlier versions are affected. Organizations should inventory Zigbee devices and gateways running EmberZNet to determine exposure. Devices that do not implement the Level Control cluster are not vulnerable. Verify your product's cluster configuration in documentation or through device management interfaces. If EmberZNet is embedded in a third-party Zigbee coordinator or end device, contact your vendor for their patching timeline.

Exploitability

Exploitability is moderately constrained. The attacker must first establish or compromise a device already joined to the target Zigbee network—a non-trivial prerequisite in most deployments. However, once network access is obtained, triggering the crash requires only sending a single malformed command with no user interaction. The attack succeeds against default configurations with no additional mitigations, and no advanced techniques are needed. The CVSS score of 6.5 (Medium) reflects this balance: high impact on availability, but low attack surface due to the authentication requirement.

Remediation

Apply the latest security patch from Silicon Labs as soon as it becomes available. Verify the patch version against the vendor advisory to confirm the divide-by-zero fault is addressed. Until patching is complete, implement network-level access controls to restrict which devices can join your Zigbee network. Review join credentials and revoke or rotate any that may have been compromised. Monitor for unexpected device join events and crashes in system logs. Consider disabling the Level Control cluster on devices that do not require it, reducing the attack surface.

Patch guidance

Monitor Silicon Labs' security advisories and product release notes for patches to EmberZNet v9.0.3 or later. Test patches in a lab environment before production deployment to ensure they do not introduce regressions. If your Zigbee solution is integrated into a third-party platform (such as a smart home hub or industrial gateway), check the vendor's patch timeline rather than updating EmberZNet directly. Document the patch version applied to each device for audit and inventory purposes.

Detection guidance

Monitor Zigbee network logs for unexpected join requests from unknown devices or repeated failed device joins, which may indicate an attacker probing the network. Log and alert on unexpected EmberZNet process crashes or restarts, especially those coinciding with unusual device communications. Review Zigbee frame captures for malformed Level Control Move commands with zero or invalid parameters. Network segmentation can help isolate affected devices and limit the blast radius if an attack occurs. Implement Zigbee-level authentication enforcement to prevent unauthorized devices from joining.

Why prioritize this

This vulnerability should be prioritized based on your deployment context. If your organization relies on Zigbee networks for critical operations (industrial control, healthcare facilities, essential infrastructure), patch as soon as updates are available. For non-critical IoT deployments, prioritize it as a medium-term remediation after critical and high-severity issues. The requirement for network access and the limitation to Level Control-equipped devices reduce urgency compared to unauthenticated remote code execution, but the simplicity of triggering a crash and its operational impact warrant timely attention.

Risk score, explained

The CVSS v3.1 score of 6.5 (Medium) reflects a high-impact availability attack (A:H) with moderate attack complexity due to authentication requirements (PR:L, network-joined device). The attacker cannot access confidential data or modify network state, making the impact scope unchanged (S:U). The score appropriately captures the risk: denial of service is disruptive but not catastrophic, and the exploit requires pre-existing network compromise or credential compromise.

Frequently asked questions