CVE-2026-85080Medium· 6.0▾ SunlitIn EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.
EmberZNet <= 9.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85079High· 7.5Out-of-bounds write in Zigbee Simple_Desc_req handling
CVE-2026-66282Medium· 6.0Authenticated Denial-of-Service in Zigbee Publish Billing Period
CVE-2026-94502High· 7.5Out-of-bounds write in Zigbee Publish Price Matrix handling
CVE-2026-66281Medium· 6.0Authenticated Denial-of-Service in Zigbee Discover Attributes Handling
CVE-2026-6432Medium· 5.3Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage
CVE-2026-15419High· 7.0CP210x Driver Memory Corruption results in Arbitrary Code Execution