In EmberZNet v9.0.2 and earlier, malformed Color Control messages can trigger an internal assert that aborts the process. The primary impact is a denial of service, disrupting network operations by terminating the affected device or process. The weakness is classified as CWE-617, reflecting improper handling of malformed input leading to an assertion failure.

Silicon Labs EmberZNet firmware versions 9.0.2 and earlier are affected. The vulnerability applies only to devices that support the Color Control cluster and have already joined the network; devices that do not support this cluster are not impacted.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send crafted Color Control messages from a device that has joined the network, suggesting the attack vector is network-based and requires prior network membership. Because the attacker must be authenticated to the network, the risk is moderate but significant for devices that rely on the Color Control cluster.