CVE-2026-66282: falha de média gravidade em Silicon Labs EmberZNet
Authenticated Denial-of-Service in Zigbee Publish Billing Period
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 0.3%
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Silicon Labs · EmberZNetCVEs relacionadas — Silicon Labs EmberZNet
No mesmo produto, das mais perigosas para as menos.
CVE-2026-85079HIGHOut-of-bounds write in Zigbee Simple_Desc_req handlingEPSS 0.7%CVE-2026-94502HIGHOut-of-bounds write in Zigbee Publish Price Matrix handlingEPSS 0.7%CVE-2026-6432MEDIUMImproper bounds validation in EmberZNet SDKEPSS 0.6%CVE-2026-85080MEDIUMAuthenticated Denial-of-Service in Zigbee GetGroupMembership HandlingEPSS 0.5%CVE-2026-47154HIGHSimple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2EPSS 0.4%CVE-2026-47153HIGHLevel Control Step With On/Off divide-by-zero in EmberZNet v9.0.2EPSS 0.4%