CVE-2025-7964
CriticalSummary
After receiving a malformed 802.15.4 MAC Data Request, the Zigbee Coordinator sends a 'network leave' request to the Zigbee router, resulting in the router getting stuck in a non-rejoinable state. If a suitable parent is not available, end devices will be unable to rejoin. Manual recommissioning is required to recover the Zigbee Router.
Risk Assessment
An attacker can cause a permanent failure of the Zigbee router, potentially leading to IoT network disruptions and unavailability of end devices.
Recommendation
It is recommended to update the Zigbee Coordinator firmware to a version that properly handles malformed MAC requests. Also, monitor the network for unusual requests.
Original NVD description (English source)
After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices will be unable to rejoin. A manual recommissioning is required to recover the Zigbee Router.