Is CVE-2026-94502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94502 being exploited in the wild.

How severe is CVE-2026-94502?

Informational severity, published 22 October 2026.

Which products and versions are affected?

Silicon Labs EmberZNet 9.1.1 and earlier; Silicon Labs SiSDK 2026.6.1 and earlier.

How is CVE-2026-94502 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-94502?

Check whether you run Silicon Labs EmberZNet or Silicon Labs SiSDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94502: Silicon Labs EmberZNet out-of-bounds write in Price cluster

CVE-2026-94502 · Severity: info · Published 2026-10-22

EmberZNet is a software development kit for Zigbee networking devices. A malformed Publish Price Matrix command can cause an out-of-bounds write vulnerability, potentially leading to remote code execution on devices that support the Price Cluster and have already joined a Zigbee network. An attacker already on the network can send a specially crafted command to compromise affected devices.

Technologies: Silicon Labs EmberZNet, Silicon Labs SiSDK. Vendors: Silicon Labs.

Quick answers

Is CVE-2026-94502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94502 being exploited in the wild.
How severe is CVE-2026-94502?: Informational severity, published 22 October 2026.
Which products and versions are affected?: Silicon Labs EmberZNet 9.1.1 and earlier; Silicon Labs SiSDK 2026.6.1 and earlier.
Is there a fix for CVE-2026-94502?: Yes: fixed in SiSDK 2026.6.2 or later; no fix available for GSDK at this time. Until then: Enable the "Platform > Security > Memory Protection Unit > Simple MPU" component in Simplicity Studio to configure the Memory Protection Unit to make RAM non-executable and prevent code injection attacks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94502 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-94502?: Check whether you run Silicon Labs EmberZNet or Silicon Labs SiSDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SiSDK 2026.6.2 or later; no fix available for GSDK at this time

Enable the "Platform > Security > Memory Protection Unit > Simple MPU" component in Simplicity Studio to configure the Memory Protection Unit to make RAM non-executable and prevent code injection attacks.

Technical details

An out-of-bounds write vulnerability exists in the handling of Publish Price Matrix commands in EmberZNet's Price Cluster implementation. The attack requires the attacker to already be on the network as a server and the target device to support the Price Cluster; remote code execution is possible if execution from RAM is not disabled. The vulnerability can be mitigated by enabling the Memory Protection Unit component to make RAM non-executable.

Affected products

Silicon Labs EmberZNet 9.1.1 and earlier
Silicon Labs SiSDK 2026.6.1 and earlier

Timeline

2026-10-22: disclosed

References

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000589.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.