Live › vulnerability › CVE-2026-66282
Go to dashboardEmberZNet 9.1.1 and earlier, the Silicon Labs Zigbee stack, mishandle a malformed Publish Billing Period command, which triggers a recursive call that never ends. An attacker on a joined device can likely crash or hang the affected node.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Zigbee devices running EmberZNet 9.1.1 or earlier that support the Price Cluster are affected. The attacker must come from a device already joined to the Zigbee network, so isolated or non-Price-Cluster devices can skip it.
No product ranges from the sources yet.
9.1.1 or earlier is affected9.1.1: unknown, the fixed version is not stated in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
This page as .md · .json · in your agent: get_signal("CVE-2026-66282")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.