A malformed Zigbee Publish Price Matrix command triggers an out-of-bounds write in the EmberZNet firmware’s Price Cluster handling routine. The flaw permits an attacker to overwrite memory beyond the intended buffer, potentially executing arbitrary code on the affected device. The weakness is a classic instance of stack or heap buffer overflow (CWE‑121).

The vulnerability is limited to devices running Silicon Labs EmberZNet firmware 9.1.1 and earlier that support the Price Cluster. Only devices that have already joined a Zigbee network can receive the malicious command; devices that do not implement the Price Cluster or are running newer firmware versions are not affected.

The CVSS score of 7.5 indicates a high severity condition, and although the EPSS score is not available, the lack of inclusion in CISA’s KEV catalog suggests that zero‑day exploitation has not been widely observed. Exploitation requires an attacker to control or relay a Zigbee command to a targeted device already on the network, which can be achieved with a compromised or malicious Zigbee node or by compromising a neighboring device that the target trusts. The attack surface is network‑bound, but internal network access or a compromised node are sufficient prerequisites.