# CVE-2026-47150: Silicon Labs EmberZNet out-of-bounds write in IAS Zone enrollment

Source: https://junglewise.ai/threats/cve-2026-47150-silicon-labs-emberznet-out-of-bounds-write-in-ias-zone-enrollment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-47150 · Severity: info · CVSS 7.1 · Published 2026-06-25

Silicon Labs EmberZNet, a software framework used for Zigbee wireless networking in smart home and industrial IoT devices, contains a vulnerability in its security sensor management. An attacker with a device already connected to the network can send a specially crafted message to crash the system. This results in a loss of connectivity and requires a device restart, potentially disrupting security monitoring or automation services.

Technologies: [Silicon Labs EmberZNet](https://junglewise.ai/threats/technologies/emberznet). Vendors: [Silicon Labs](https://junglewise.ai/threats/vendors/silicon-labs).

## Quick answers

**Is CVE-2026-47150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47150 being exploited in the wild.

**How severe is CVE-2026-47150?** Informational severity, with a CVSS score of 7.1, published 25 June 2026.

**Which products and versions are affected?** Silicon Labs EmberZNet v9.0.2 and earlier.

**Is there a fix for CVE-2026-47150?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47150 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-47150?** Check whether you run Silicon Labs EmberZNet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds (OOB) write vulnerability exists in Silicon Labs EmberZNet v9.0.2 and earlier within the handling of Intruder Alarm System (IAS) Zone enrollment messages. The root cause is a failure to properly validate malformed enrollment messages, which triggers an OOB write to the state-table. While the size and location of the write are limited, it is sufficient to terminate the process (Denial of Service). Exploitation requires the attacker to be using a device that has already successfully joined the Zigbee network (PR:L) and targets devices supporting the IAS Zone cluster. Silicon Labs has addressed this in newer releases of the Simplicity SDK / EmberZNet.

## Affected products

- Silicon Labs EmberZNet v9.0.2 and earlier

## Timeline

- 2026-06-25: advisory: Initial disclosure by Silicon Labs

## References

- [https://github.com/SiliconLabsSoftware/sisdk-release/](https://github.com/SiliconLabsSoftware/sisdk-release/)
- [https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1](https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pEGPQIA4?operationContext=S1)

## Related threats

- [Silicon Labs EmberZNet out-of-bounds write in Price cluster](https://junglewise.ai/threats/cve-2026-94502-in-emberznet-9-1-1-and-earlier-a-malformed-publish-price-matrix)
- [Silicon Labs EmberZNet out-of-bounds write in Group Cluster](https://junglewise.ai/threats/cve-2026-85080-in-emberznet-9-1-1-and-earlier-a-malformed-getgroupmembership)
- [Silicon Labs EmberZNet out-of-bounds write in Simple_Desc_req](https://junglewise.ai/threats/cve-2026-85079-in-emberznet-9-1-1-and-earlier-a-malformed-simple-desc-req)
- [Silicon Labs EmberZNet denial-of-service in Price Cluster](https://junglewise.ai/threats/cve-2026-66282-in-emberznet-9-1-1-and-earlier-a-malformed-publish-billing-period)
- [Silicon Labs EmberZNet denial-of-service in Discover Attributes](https://junglewise.ai/threats/cve-2026-66281-in-emberznet-9-1-1-and-earlier-a-malformed-discover-attributes)