PT-2026-52402 · Silicon+1 · Ember Znet

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-47149

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-47149

Affected Products

Ember Znet

References · 3

• https://github.com/SiliconLabsSoftware/sisdk-release · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47149 · Security Note
• https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1 · Vendor Advisory