{"id":"CVE-2026-94502","kind":"vulnerability","aliases":["CVE-2026-94502"],"related":[],"title":"EmberZNet: malformed Price Matrix command enables out-of-bounds write","description":"In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.","summary":"EmberZNet 9.1.1 and earlier, Silicon Labs' Zigbee stack, mishandles a malformed Publish Price Matrix command, causing an out-of-bounds write. The sources say this could lead to remote code execution on affected devices, but only from a device already joined to the network.","severity":"high","cvss":7.5,"epss":0.0024,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embernet","infrastructure","iot-devices","silicon-labs","zigbee"],"not_affected_if":["no-price-cluster","not-on-embernet-9.1.1-or-earlier"],"how_to_check":"- Check the EmberZNet SDK version in use: `unknown` if the sources do not say which build your product includes.\n- Check whether devices run the Price Cluster (ZCL Price cluster, the Publish Price Matrix command): `unknown` if the sources do not say how to confirm this from the device.","fix":"- Move to an EmberZNet release newer than `9.1.1`: `unknown` if the sources do not name the fixed version.\n- Check the vendor advisory for the patched firmware for your device: `unknown`.","status":"open","published_at":"2026-10-22T14:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:15:13+00:00","updated_at":"2026-10-25T03:15:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:15:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move to an EmberZNet release newer than `9.1.1`: `unknown` if the sources do not name the fixed version.\n- Check the vendor advisory for the patched firmware for your device: `unknown`.","reach":"network","title":"EmberZNet: malformed Price Matrix command enables out-of-bounds write","impact":"high","summary":"EmberZNet 9.1.1 and earlier, Silicon Labs' Zigbee stack, mishandles a malformed Publish Price Matrix command, causing an out-of-bounds write. The sources say this could lead to remote code execution on affected devices, but only from a device already joined to the network.","category":"infrastructure","nicknames":[],"who_cares":["zigbee","embernet","silicon-labs","iot-devices"],"confidence":0.6,"needs_auth":"yes","worst_case":"Remote code execution on a Zigbee device via a joined device","analyst_note":"Find the vendor advisory and the fixed EmberZNet version, and confirm the exact affected SDK releases and any patch for the Price Cluster.","how_to_check":"- Check the EmberZNet SDK version in use: `unknown` if the sources do not say which build your product includes.\n- Check whether devices run the Price Cluster (ZCL Price cluster, the Publish Price Matrix command): `unknown` if the sources do not say how to confirm this from the device.","needs_analyst":true,"not_affected_if":["no-price-cluster","not-on-embernet-9.1.1-or-earlier"],"who_is_affected":"Only devices built on EmberZNet 9.1.1 or earlier that support the Price Cluster are affected. The attacker must already be a device joined to the Zigbee network, so networks where only trusted devices can join are lower risk. Teams that do not ship Zigbee devices or gateways built on EmberZNet can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":3357,"output_tokens":677,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-94502':14A,17A '9.1.1':28B,74C 'affect':60B 'alreadi':67B,107C 'bound':10A,47B,90C 'caus':42B 'cluster':116C 'code':57B,96C 'come':101C 'command':5A,41B,82C 'could':53B 'cve':12A,15A 'devic':22B,61B,66B,104C,112C 'earlier':30B,76C 'embernet':18B 'emberznet':1A,27B,73C 'enabl':6A 'execut':58B,97C 'impact':118C 'infrastructur':19B 'iot':21B 'iot-devic':20B 'join':68B,108C 'lab':25B,32B 'lead':54B,93C 'malform':2A,37B,78C 'matrix':4A,40B,81C 'messag':99C 'mishandl':35B 'must':100C 'network':71B,110C 'out-of-bound':7A,44B,87C 'potenti':92C 'price':3A,39B,80C,115C 'publish':38B,79C 'remot':56B,95C 'result':84C 'say':51B 'silicon':24B,31B 'silicon-lab':23B 'sourc':50B 'stack':34B 'support':113C 'write':11A,48B,91C 'zigbe':26B,33B","nicknames":[],"mitigations":[],"who_affected":"Only devices built on EmberZNet 9.1.1 or earlier that support the Price Cluster are affected. The attacker must already be a device joined to the Zigbee network, so networks where only trusted devices can join are lower risk. Teams that do not ship Zigbee devices or gateways built on EmberZNet can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T14:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"product-security@silabs.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94502","severity":null,"published_at":"2026-10-22T14:17:51+00:00","modified_at":"2026-10-23T12:18:19+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94502","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94502","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}