CVE-2026-94502High· 7.5▾ TwilightIn EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
EmberZNet <= 9.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85079High· 7.5Out-of-bounds write in Zigbee Simple_Desc_req handling
CVE-2026-85080Medium· 6.0Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling
CVE-2026-66282Medium· 6.0Authenticated Denial-of-Service in Zigbee Publish Billing Period
CVE-2026-66281Medium· 6.0Authenticated Denial-of-Service in Zigbee Discover Attributes Handling
CVE-2026-6432Medium· 5.3Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage
CVE-2026-15419High· 7.0CP210x Driver Memory Corruption results in Arbitrary Code Execution