Out-of-Bounds Read Vulnerability in EmberZNet by Silicon Labs
CVE-2026-47147

7.1HIGH

Key Information:

Vendor

Silicon Labs

Status
Emberznet
Vendor
CVE Published:
25 June 2026

What is CVE-2026-47147?

EmberZNet versions 9.0.2 and earlier are susceptible to a significant vulnerability where malformed Over-The-Air (OTA) requests can cause the OTA server parser to perform out-of-bounds reads. When a device that is already part of the network sends these requests, it can retrieve a limited amount of RAM data back from the server. This vulnerability primarily affects devices that support the OTA Server cluster, potentially allowing unauthorized access to sensitive system data.

Affected Version(s)

EmberZNet 0 <= 9.0.2

References

https://siliconlabs.lightning.force.com/sfc/servlet.sheph...
vendor-advisorypermissions-required
https://github.com/SiliconLabsSoftware/sisdk-release/
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Junming C. (@Chapoly1305) and Prof. Qiang Zeng of George Mason University
.