EmberZNet firmware implements the Zigbee Color Control cluster, and a malformed hue/saturation message can trigger an assertion failure that terminates the device process. The vulnerability is driven by CWE‑617, which reflects an incorrect handling of input data that leads to a hard‑coded failure. When triggered, the device crashes and is unable to fulfill its role in the network, effectively denying service to legitimate users and other nodes that depend on that device for color control functions.

Silicon Labs EmberZNet firmware versions 9.0.2 and earlier are affected. Only devices that have joined the network and support the Color Control cluster can send the malformed messages that trigger the abort. No other clusters or devices are impacted by this flaw.

The flaw has a CVSS score of 7.1, indicating a high severity. Exploitation requires a device already on the network to send a crafted Color Control message; thus, the attack vector is network‑based. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but given the potential for service disruption, it remains a strategic concern. An attacker who can influence the network traffic, such as by spoofing an authenticated device or joining the network, could repeatedly trigger device crashes and cause widespread connectivity issues.