CVE-2026-47153: EmberZNet Level Control Divide-by-Zero DoS Vulnerability

Technical summary

CVE-2026-47153 is a divide-by-zero vulnerability (CWE-369) in EmberZNet's Level Control cluster command processing. When a malformed Level Control Step command is received from an authenticated network node, the firmware fails to validate a critical numeric parameter before performing a division operation. This triggers an unhandled fault condition that crashes the application process. The vulnerability requires network access and prior device enrollment; it does not grant authentication bypass, data exfiltration, or code execution.

Business impact

In production IoT and smart-home environments, this vulnerability enables denial-of-service attacks from compromised or rogue network devices. An attacker with access to a Zigbee network (e.g., through stolen credentials, physical proximity, or a malicious device) can force repeated crashes of Level Control-enabled devices (lights, dimmers, switches). This disrupts automation routines, increases operational overhead for recovery and diagnostics, and could cascade if Level Control devices are part of critical building management or industrial control systems.

Affected systems

Silicon Labs EmberZNet v9.0.2 and all earlier versions are vulnerable. Only deployments using devices that support the Zigbee Level Control cluster are at risk. This typically includes smart bulbs, dimmer modules, color-tunable lights, and related actuators. Devices lacking Level Control cluster support are unaffected. Check your device's Zigbee cluster support documentation to determine exposure.

Exploitability

Exploitability is moderate. The attacker must be a legitimate or rogue device already joined to the Zigbee network—external, unauthenticated attacks are not possible. However, once on the network, crafting the malformed command is trivial and requires no user interaction. Network-adjacent attackers or insiders with Zigbee hardware can execute this within minutes. The CVSS score of 6.5 (Medium) reflects high availability impact but limited scope due to the network-join prerequisite.

Remediation

Update EmberZNet to a patched version released after v9.0.2. Verify the specific patch version against Silicon Labs' official security advisory. In the interim, restrict Zigbee network membership to trusted devices, implement network segmentation to isolate Level Control devices from untrusted segments, and monitor for repeated process crashes on affected devices. Review access logs to identify unauthorized device join events.

Patch guidance

Silicon Labs will issue a patch for EmberZNet addressing this divide-by-zero flaw. Check the official Silicon Labs security advisory for the exact patched version number and release timeline. Update in a staged approach: test patches in a non-production environment first, verify Level Control functionality post-update, and monitor for any regression in network stability. If you are running a version management system for IoT firmware, ensure the update is deployed uniformly across all affected devices.

Detection guidance

Monitor for repeated process crashes or restarts on EmberZNet-based Level Control devices, particularly if the restarts correlate with suspicious device join events or command traffic anomalies. Enable debug logging to capture incoming Level Control Step commands and identify malformed packets (e.g., division-by-zero parameter values). Network intrusion detection systems tuned for Zigbee can flag abnormal command sequences. Establish baseline crash metrics for your deployment so that sudden spikes in Level Control device reboots trigger alerts.

Why prioritize this

While this is a Medium-severity vulnerability, organizations relying on Zigbee for critical automation (industrial controls, healthcare facilities, large building automation) should prioritize patching. The divide-by-zero is easy to trigger repeatedly, making it a practical denial-of-service tool for network-adjacent attackers. Conversely, purely consumer smart-home deployments with strong network security controls (e.g., password-protected Zigbee coordinators, restricted join windows) face lower operational risk but should still schedule updates within normal maintenance windows.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), requirement for prior network membership (PR:L), no user interaction (UI:N), unchanged scope (S:U), zero confidentiality impact (C:N), zero integrity impact (I:N), and high availability impact (A:H). The PR:L requirement—mandatory network enrollment—prevents this from being High or Critical, despite the certainty of denial of service once the precondition is met.

Frequently asked questions