CVE-2026-47154
Description
In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.
Summary dbcve.org
Out-of-bounds read vulnerability in EmberZNet's Simple Metering cluster GetProfileResponse message handling. A malformed GetProfileResponse with malicious interval entry data triggers the out-of-bounds read during iteration, causing process termination (DoS). Exploitation requires an already-authenticated device on the network.
Mitigation
Update EmberZNet to a version beyond 9.0.2 when the vendor patch becomes available; apply network segmentation to limit Simple Metering cluster exposure to trusted devices only.