A malformed GetGroupMembership message can cause an out‑of‑bounds write that crashes the device. The attack does not provide a path to remote code execution, but it can bring a device offline. The vulnerability is limited to a few values that can be written, so it does not allow arbitrary data injection. The CVSS vector indicates a moderate severity. No exploit is currently available in publicly known tools, and the vulnerability is not listed in the CISA KEV catalog.

Silicon Labs EmberZNet firmware versions 9.1.1 and earlier on devices that support the Group Cluster. Only devices that have already joined the network can trigger the vulnerability; standalone devices or those without the Group Cluster are not affected.

The CVSS score of 6.0 reflects a moderate impact: a crash disrupts service but does not compromise confidentiality or integrity. The EPSS score is not available, but the lack of a remote code execution route suggests the likelihood of exploitation is lower in unsophisticated attackers. Because the message must be sent by an authenticated device that has joined the network, the attack vector is an authenticated Zigbee network sender, possibly a compromised or malicious node. The crash can be used to disrupt network availability, but it does not provide persistent access or data theft. Given these factors, the risk is moderate but notable for network reliability.