A malformed Simple_Desc_req response in EmberZNet 9.1.1 and earlier can cause an out‑of‑bounds write that potentially leads to remote code execution. The flaw is a stack‑based buffer overflow (CWE‑121). The vulnerability is triggered when a device that has already joined the network sends the malformed response during a Simple_Desc_req exchange, and the attacker must wait for that request to be initiated before the payload can be delivered.

The affected product is Silicon Labs EmberZNet firmware version 9.1.1 and earlier, used in Zigbee devices that participate in a network.

The CVSS score of 7.5 indicates a high risk and the EPSS score is not available, so the current likelihood of exploitation is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at this time. An attacker would need to control a Zigbee device that can send a malicious Simple_Desc_req to a target device that is already a member of the network. The attack vector, therefore, is inferred to be remote over Zigbee, requiring the attacker to be on the same network and to wait until a Simple_Desc_req is requested before the exploit can be executed.