A malformed Publish Billing Period command triggers an infinite recursive function call in EmberZNet 9.1.1 and earlier. The recursion never reaches its exit condition, exhausting system resources and preventing the network stack from servicing other messages. The flaw is triggered only by messages originating from a device that has already joined the network, so an attacker must have an authenticated or compromised node to leverage it. The result is a denial of service that can disrupt the operation of the affected device and, by extension, the wireless network. This weakness corresponds to CWE-674.

The vulnerability affects Silicon Labs EmberZNet firmware versions 9.1.1 and older. Only devices that implement the Price cluster are impacted. All such devices that have joined a network using these firmware versions are eligible to generate the faulty Publish Billing Period command and trigger the denial of service.

The CVSS score of 6 indicates a medium severity with significant impact on availability. The EPSS value is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA KEV, which suggests no confirmed exploits have been reported yet. The attack requires an authenticated or compromised node on the network; therefore, the vector is limited to devices already participating in the Zigbee network. Once the command is sent, the infinite recursion can be sustained until the device or its host is rebooted, stopping normal network operations.