Recursive Function Call Vulnerability in EmberZNet from Silicon Labs
CVE-2026-66282

6MEDIUM

Key Information:

Vendor

Silicon Labs

Status
Emberznet
Vendor
CVE Published:
22 October 2026

What is CVE-2026-66282?

In versions of EmberZNet 9.1.1 and earlier, an attacker can exploit a malformed Publish Billing Period command, causing the software to enter a state of endless recursion. This flaw only affects devices that have previously joined the network and support the Price Cluster, potentially leading to service disruption and degraded performance. It is essential for users to be aware of this issue and seek remediation measures.

Affected Version(s)

EmberZNet 0 <= 9.1.1

References

https://github.com/SiliconLabsSoftware/docs-security-advi...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Junming C. (@Chapoly1305) and Prof. Qiang Zeng of George Mason University
.