Malformed GetGroupMembership commands in EmberZNet v9.0.2 and earlier can cause the device to repeatedly read past the end of the message payload, triggering a process termination. The fault does not leak data back to the sender, but it can crash any node that supports the Groups cluster, disrupting network operations and potentially causing a denial of service for devices relying on that firmware.

Silicon Labs EmberZNet firmware v9.0.2 and all earlier releases are affected. Only devices that support the Groups cluster are susceptible to the crash. No other vendors or product versions are impacted according to the CNA data.

The CVSS score of 7.1 classifies the flaw as high severity, indicating significant impact if exploited. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited widespread exploitation to date. However, the attack vector requires a device that has already joined the network and the ability to send malformed GetGroupMembership messages locally, which is feasible for an attacker with network access. The risk is moderate to high for networks with unsupervised or legacy firmware.