CVE-2026-47149 Silicon Labs CVE debrief

Who should care

Defenders responsible for IoT devices, particularly those using EmberZNet for the Door Lock cluster, should assess exposure and prioritize updates. They should verify and update vulnerable versions, especially for devices supporting the Door Lock cluster. The vulnerability requires the messages to come from a device that has already joined the network and does not result in information leakage back to the sender.

Why it matters

CVE-2026-47149 is a high-severity vulnerability in EmberZNet that can lead to process termination. Defenders should verify and update vulnerable versions, especially for devices supporting the Door Lock cluster, as exploitation requires a joined network device sending malformed identifiers.

• Verification of EmberZNet version and exposure of Door Lock cluster devices
• Potential process termination due to out-of-bounds table reads
• Need for updates to prevent exploitation

Technical summary

EmberZNet v9.0.2 and earlier are vulnerable to out-of-bounds table reads due to malformed or out-of-range Door Lock user identifiers. This issue requires the messages to come from a device that has already joined the network and does not result in information leakage back to the sender. The vulnerability affects devices supporting the Door Lock cluster. Defenders should verify and update vulnerable versions, especially for devices supporting the Door Lock cluster. The vulnerability can lead to process termination, but there is no information leakage back to the sender.

Defensive priority

Defenders should prioritize verifying and updating vulnerable EmberZNet versions, especially for devices supporting the Door Lock cluster.

Recommended defensive actions

• Verify and update EmberZNet versions to the latest available
• Assess exposure of devices supporting the Door Lock cluster
• Monitor for unusual activity related to Door Lock user identifiers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its impact on devices supporting the Door Lock cluster. The vulnerability was publicly disclosed on June 25, 2026. There are no known instances of exploitation. However, defenders should still verify and update vulnerable versions, especially for devices supporting the Door Lock cluster. The CVE record and NVD entry provide further information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.