An attacker can craft a malformed GetProfileResponse message for the Simple Metering cluster, which, when processed by EmberZNet v9.0.2 or earlier, causes an out‑of‑bounds read while iterating interval entries. The read triggers a process termination, resulting in a denial‑of‑service condition. No confidential data is leaked back to the attacker. The flaw falls under CWE‑125: Incorrect Boundary Conditions.

Silicon Labs EmberZNet firmware versions 9.0.2 and earlier are affected. Only devices that support the Simple Metering cluster are vulnerable, so typical Zigbee appliances such as smart meters or energy‑management units running the affected firmware are at risk. Devices without the Simple Metering cluster are not impacted.

The CVSS score of 7.1 indicates a moderate to high risk. EPSS is not available, but the flaw requires a source device already on the Zigbee network to send the malformed message, suggesting a moderate exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, reducing immediacy of observed attacks. Nonetheless, any device using the vulnerable firmware that can communicate within the network remains at risk for a local denial‑of‑service attack.