{"id":"CVE-2026-85080","kind":"vulnerability","aliases":["CVE-2026-85080"],"related":[],"title":"EmberZNet: malformed GetGroupMembership message crashes Zigbee device stack","description":"In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.","summary":"EmberZNet 9.1.1 and earlier mishandle a malformed GetGroupMembership message, causing an out-of-bounds write that crashes the device. The sources say only a limited set of values can be written and no remote code execution route was observed.","severity":"medium","cvss":6.0,"epss":0.00354,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","silicon-labs-emberznet","zigbee"],"not_affected_if":["network-without-untrusted-devices","no-group-cluster"],"how_to_check":"- Check the EmberZNet SDK version on the device firmware, unknown if the sources give a command\n- Check whether the device supports the Group Cluster, per the sources only those devices are impacted","fix":"- Move EmberZNet to a release newer than `9.1.1`, unknown exact fixed version in the sources","status":"open","published_at":"2026-10-22T14:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:05:23+00:00","updated_at":"2026-10-25T04:05:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:05:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move EmberZNet to a release newer than `9.1.1`, unknown exact fixed version in the sources","reach":"network","title":"EmberZNet: malformed GetGroupMembership message crashes Zigbee device stack","impact":"low","summary":"EmberZNet 9.1.1 and earlier mishandle a malformed GetGroupMembership message, causing an out-of-bounds write that crashes the device. The sources say only a limited set of values can be written and no remote code execution route was observed.","category":"infrastructure","nicknames":[],"who_cares":["zigbee","embedded","silicon-labs-emberznet"],"confidence":0.6,"needs_auth":"yes","worst_case":"Device crashes; limited values written, no code execution observed","analyst_note":"Confirm the fixed EmberZNet version and affected SDK list from the NVD and vendor advisory pages; sources give no fix version.","how_to_check":"- Check the EmberZNet SDK version on the device firmware, unknown if the sources give a command\n- Check whether the device supports the Group Cluster, per the sources only those devices are impacted","needs_analyst":true,"not_affected_if":["no-group-cluster","network-without-untrusted-devices"],"who_is_affected":"Only Zigbee devices running EmberZNet 9.1.1 or earlier that support the Group Cluster are impacted. The attacker must come from a device that has already joined the network, so networks with no untrusted joined devices are at lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3383,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-85080':11A,14A '9.1.1':23B,64C 'alreadi':113C 'bound':36B,78C 'caus':31B 'cluster':122C 'code':57B,100C 'come':107C 'crash':5A,39B,83C 'cve':9A,12A 'devic':7A,41B,110C,118C 'earlier':25B,66C 'embed':15B 'emberznet':1A,20B,22B,63C 'execut':58B,101C 'getgroupmembership':3A,29B,69C 'group':121C 'impact':124C 'infrastructur':16B 'join':114C 'lab':19B 'lead':80C 'limit':47B,85C 'malform':2A,28B,68C 'messag':4A,30B,70C,105C 'mishandl':26B 'must':106C 'network':116C 'number':86C 'observ':61B,103C 'out-of-bound':33B,75C 'remot':56B,99C 'result':72C 'rout':59B,97C 'say':44B 'set':48B 'silicon':18B 'silicon-labs-emberznet':17B 'sourc':43B 'stack':8A 'support':119C 'use':92C 'valu':50B,88C 'vulner':94C 'write':37B,79C 'written':53B,91C 'zigbe':6A,21B","nicknames":[],"mitigations":[],"who_affected":"Only Zigbee devices running EmberZNet 9.1.1 or earlier that support the Group Cluster are impacted. The attacker must come from a device that has already joined the network, so networks with no untrusted joined devices are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"product-security@silabs.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85080","severity":null,"published_at":"2026-10-22T14:17:51+00:00","modified_at":"2026-10-23T12:18:16+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85080","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85080","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}