In EmberZNet v9.0.2 and earlier, a flaw in the global ZCL command parser allows an attacker to send crafted ZCL messages that contain insufficient length checks, leading to an out‑of‑bounds read in the parsing routine and a process crash. The vulnerability is classified as a local denial of service, as it causes the Zigbee network stack to terminate without leaking any data back to the sender. The weakness corresponds to CWE‑125, which describes out‑of‑bounds read errors.

The affected product is Silicon Labs' EmberZNet firmware versions 9.0.2 and all earlier releases. Devices running this firmware—typically Zigbee‑based IoT gateways, routers, or sensors that support global ZCL command processing—are susceptible. Only systems that are part of a Zigbee network and that accept global ZCL messages from joined devices face this risk.

The CVSS score of 7.1 indicates a high severity DoS risk. EPSS is not available, so the current exploit probability is unknown, but the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread use yet. Exploitation requires a malicious or compromised device that has already joined the network and can send malformed ZCL frames; the attacker does not need elevation or external access. Because the flaw triggers a crash without informational leakage, the primary concern is service interruption, especially for critical IoT deployments that rely on continuous operation.