CVE-2026-47145
Description
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.
Summary dbcve.org
In EmberZNet versions 9.0.2 and earlier, the Zigbee ZCL Color Control cluster implementation lacks proper input validation for incoming messages. When a malformed Color Control message is received from an authenticated network device, it triggers an assertion failure that terminates the process, causing a denial of service.
Mitigation
Implement robust input validation and error handling in the Color Control cluster message parser to gracefully handle malformed messages instead of asserting. Additionally, enforce network access controls to prevent unauthorized devices from joining.