CVE-2026-47154: EmberZNet Simple Metering Out-of-Bounds Read DoS Vulnerability

Technical summary

CVE-2026-47154 is an out-of-bounds read vulnerability in EmberZNet v9.0.2 and earlier triggered by malformed GetProfileResponse messages. The flaw occurs during iteration of interval entries within the Simple Metering cluster implementation, causing the process to terminate. The vulnerability is classified as CWE-125 (Out-of-bounds Read) and requires the attacker to originate the malicious message from an already-joined network device, making unauthorized remote exploitation unlikely without prior network compromise.

Business impact

Organizations deploying EmberZNet-based smart metering infrastructure face potential denial-of-service conditions. While the impact is limited to process termination (not data compromise), repeated attacks could degrade metering service availability and require operational intervention to restore devices. The requirement for network-authenticated access and device presence reduces the immediate threat surface, but any deployed vulnerability still represents a stability and uptime risk.

Affected systems

Silicon Labs EmberZNet version 9.0.2 and all earlier versions are affected. Only devices implementing the Simple Metering cluster are impacted; other cluster types are unaffected. This impacts smart metering deployments, building energy management systems, and utility-grade IoT devices based on the EmberZNet stack.

Exploitability

Exploitation requires network access and authenticated device status. An attacker cannot trigger this remotely from an unauthenticated position; the malformed message must originate from a device that has already successfully joined the mesh network. While the attack surface is constrained by these prerequisites, any previously joined device—including compromised sensors or gateways—can deliver the payload. No exploit code is publicly available, and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Silicon Labs has released patches for EmberZNet. Organizations should upgrade to the patched version specified in the official Silicon Labs security advisory. For systems where immediate patching is not feasible, implement network segmentation to restrict which devices can join the network and monitor for unexpected GetProfileResponse traffic patterns indicating reconnaissance or attack attempts.

Patch guidance

Verify the latest patched version from the Silicon Labs security advisory and test in a controlled environment before production deployment. Prioritize metering gateways and coordinator nodes, as these are high-value targets for denial-of-service. Schedule patching around maintenance windows to minimize metering service interruption. Confirm that the patched version maintains backward compatibility with existing sensors and infrastructure.

Detection guidance

Monitor for repeated GetProfileResponse message failures or process crashes on SimpleMetering cluster handlers. Network-level detection should focus on identifying malformed GetProfileResponse frames from joined devices, particularly those with unexpected or suspicious source addresses. Enable device-level logging and alerting for interval entry processing errors. Track unexpected restarts or service interruptions on metering endpoints and correlate with network traffic analysis.

Why prioritize this

Although the CVSS score of 6.5 is medium, the combination of ease of exploitation (once network access is gained), the critical nature of metering infrastructure, and the operational impact of repeated denial-of-service warrant prioritization. Systems in production utility and commercial metering environments should be treated as higher priority than lab or test deployments. The lack of current public exploits provides a window for orderly patching before widespread awareness increases risk.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the high availability impact (complete process termination) balanced against the requirement for authenticated network presence and the absence of confidentiality or integrity compromise. The vector (CVSS:3.1/AV:N/AC:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) acknowledges that while network access is required, once an attacker is on the network, exploitation is straightforward with no additional conditions.

Frequently asked questions