| CVE-2026-94502 | CRÍTICO9.8 | In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted. | 22/10/2026 |
| CVE-2026-85080 | CRÍTICO9.1 | In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the networ | 22/10/2026 |
| CVE-2026-85079 | CRÍTICO9.8 | In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed. | 22/10/2026 |
| CVE-2026-66282 | ALTO7.5 | In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted. | 22/10/2026 |
| CVE-2026-66281 | ALTO7.5 | In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted. | 22/10/2026 |
| CVE-2026-4526 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. | 25/06/2026 |
| CVE-2026-47154 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices support | 25/06/2026 |
| CVE-2026-47153 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | 25/06/2026 |
| CVE-2026-47152 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | 25/06/2026 |
| CVE-2026-47151 | ALTO7.1 | In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacte | 25/06/2026 |
| CVE-2026-47150 | ALTO7.1 | In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may b | 25/06/2026 |
| CVE-2026-47149 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door | 25/06/2026 |
| CVE-2026-47148 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting | 25/06/2026 |
| CVE-2026-47147 | ALTO7.1 | In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices suppo | 25/06/2026 |
| CVE-2026-47146 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | 25/06/2026 |
| CVE-2026-47145 | MÉDIO6.5 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | 25/06/2026 |
| CVE-2025-12131 | MÉDIO6.5 | A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. | 05/02/2026 |
| CVE-2024-50931 | MÉDIO4.6 | Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. | 10/12/2024 |
| CVE-2024-50930 | ALTO8.8 | An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. | 10/12/2024 |
| CVE-2024-50929 | MÉDIO6.2 | Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS). | 10/12/2024 |