Medium severity · published Jun 25, 2026
CVE-2026-47148
Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EmberZNet · Silicon Labs
through 9.0.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47148
Not Applicable
https://github.com/SiliconLabsSoftware/sisdk-release/
Permissions Required
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1
More from EmberZNet
7.5
CVE-2026-85079
Out-of-bounds write in Zigbee Simple_Desc_req handling
7.5
CVE-2026-94502
Out-of-bounds write in Zigbee Publish Price Matrix handling
7.1
CVE-2026-47151
Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2
7.1
CVE-2026-47150
IAS Zone enroll invalid table index and write in EmberZNet 9.0.2
7.1
CVE-2026-47147
OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2