CVE-2026-47145
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. Only devices that have already joined the network and support the Color Control cluster may be impacted.
Risk Assessment
Organizations may experience unexpected service interruptions, potentially leading to loss of service availability.
Recommendation
It is recommended to upgrade to a newer version of EmberZNet to mitigate the risks associated with this vulnerability.
Other vulnerabilities in EmberZNet
See all- CVE-2026-4526Medium
In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network.
- CVE-2026-47154Medium
In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries, resulting in process termination. These messages must come from a device that has already joined the network.
- CVE-2026-47153Medium
In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network.
- CVE-2026-47152Medium
In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network.
- CVE-2026-47151High
In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. Only devices that have already joined the network and support the Door Lock cluster may be impacted.
- CVE-2026-47150High
In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited.
- CVE-2026-47149Medium
In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These issues occur only in devices that have already joined the network.
- CVE-2026-47148Medium
In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload, leading to process termination. These messages must come from a device that has already joined the network.
- CVE-2026-47147High
In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester.
- CVE-2026-47146Medium
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. Only devices that have already joined the network and support the Color Control cluster may be impacted.
Original NVD description (English source)
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.