The flaw occurs when EmberZNet processes a Level Control Move command that contains a malformed value, causing a divide‑by‑zero error which terminates the application. The attack can only be triggered from a device that has already joined the network. The resulting denial of service can bring down the affected node's z‑stack and may disrupt network operations.

Affected are devices running Silicon Labs EmberZNet firmware version 9.0.2 or older. Only devices that implement the Level Control cluster are susceptible. This includes IoT endpoints such as smart plugs or dimmer controllers that use EmberZNet’s Level Control functionality.

The CVSS score of 7.1 indicates a medium severity vulnerability. EPSS is not available, but the flaw is not listed in CISA KEV, suggesting no known active exploitation. Attack is likely local network based; an adversary must have a network presence to send the crafted command. If they can compromise or emulate a legitimate joined device, they could cause the node to crash, potentially cascading failures in the network if many nodes are affected.