CVE-2026-85080 in EmberZNet
Summary
by MITRE • 10/23/2026
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within EmberZNet versions 9.1.1 and earlier, specifically affecting components responsible for handling group cluster operations in Zigbee-based networks. The core technical flaw is an out-of-bounds write triggered by a malformed GetGroupMembership message. This type of memory corruption occurs when the application layer fails to adequately validate the length or structure of incoming network messages before processing them. Instead of rejecting invalid payloads, the software proceeds with memory allocation and copy operations that exceed the bounds of the intended buffer. While this results in a crash due to memory protection violations or stack corruption, analysis indicates that the write operation is highly constrained. The attacker can only control a limited number of values within the corrupted memory region, which significantly restricts the potential for arbitrary code execution. Consequently, while the integrity and availability of the device are compromised through denial-of-service conditions, there is no observed pathway to achieve remote code execution from this specific flaw alone.
From an operational perspective, this vulnerability impacts only devices that support the Group Cluster functionality within the Zigbee protocol stack. The exploitation requires a significant level of network proximity and trust because the malicious GetGroupMembership message must originate from a device that has already successfully joined the network. This prerequisite means that an external attacker cannot exploit this flaw directly over the air without first compromising or spoofing a legitimate node on the local area network. Once inside, however, an adversary can send crafted messages to trigger the buffer overflow, causing the affected Zigbee coordinator or router to crash. Such crashes disrupt mesh network stability and may require manual intervention or reboot cycles to restore service, leading to operational downtime for smart home or industrial IoT deployments relying on these devices.
In terms of classification standards, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input, which describes the fundamental error of copying data into a buffer without verifying that it fits within allocated space. Furthermore, because exploitation requires prior network access and authentication via device joining, it does not fit neatly into remote code execution categories but rather represents an availability risk for authenticated actors. The ATT&CK framework categorizes this under techniques related to Denial of Service, specifically where the attacker leverages application layer protocols to disrupt service continuity. It is important to note that while memory corruption vulnerabilities often raise concerns about privilege escalation or code injection, the constrained nature of writes in this instance limits the attack surface primarily to stability and availability impacts rather than full system compromise.
Mitigation strategies should focus on immediate software updates provided by Silicon Labs for EmberZNet versions prior to 9.1.2, which include patches addressing input validation logic within the Group Cluster implementation. Network administrators must ensure that all Zigbee devices are running patched firmware to prevent exploitation of this out-of-bounds write condition. Additionally, since the attack vector requires a pre-joined device, enforcing strict network access controls and monitoring for anomalous group membership requests from known nodes can provide an additional layer of defense. Implementing intrusion detection systems capable of identifying malformed Zigbee frames may also help in detecting attempted exploitation before it triggers a crash. Regular auditing of connected devices and limiting the number of trusted endpoints further reduces the risk surface, ensuring that even if one node is compromised, the ability to disrupt the broader network through this specific vulnerability remains contained.