Live › vulnerability › CVE-2026-66281
Go to dashboardA malformed Discover Attributes command in EmberZNet 9.1.1 and earlier puts the device into a loop with no reachable exit, which hangs it. Only devices that support manufacturer-specific clusters are impacted, and the message has to come from a device already joined to the network.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Zigbee devices built on EmberZNet 9.1.1 and earlier that support manufacturer-specific clusters are affected. The attacker must already be a device joined to the Zigbee network, so networks with no untrusted joined devices are at lower risk. Devices without manufacturer-specific clusters are not impacted.
No product ranges from the sources yet.
9.1.1 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.
This page as .md · .json · in your agent: get_signal("CVE-2026-66281")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.