CVE-2026-47150 Silicon Labs CVE debrief

Who should care

Defenders responsible for network devices supporting the IAS Zone cluster should assess exposure and prioritize verification of affected versions and remediation. This includes operators, security teams, and vulnerability management teams who need to review the vulnerability's impact on their systems and plan for remediation.

Why it matters

Defenders should prioritize verifying network devices supporting the IAS Zone cluster and assess exposure to potential malformed messages. The vulnerability allows malformed IAS Zone enrollment messages to terminate the process, but the size and location of the write is limited. These messages must come from a device that has already joined the network.

• Potential process termination due to malformed messages
• Limited out-of-bounds state-table write
• Verification of network device exposure is required
• Remediation priority is uncertain without additional information

Technical summary

Malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process in EmberZNet v9.0.2 and earlier. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted. The vulnerability allows for potential process termination due to malformed messages and limited out-of-bounds state-table write. Defenders should assess exposure and prioritize verification of affected versions and remediation.

Defensive priority

Defenders should prioritize verifying network devices supporting the IAS Zone cluster and assess exposure to potential malformed messages.

Recommended defensive actions

• Verify network devices supporting the IAS Zone cluster for potential exposure
• Assess and limit network access for devices that have already joined the network
• Monitor for malformed IAS Zone enrollment messages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. The source corpus provides evidence that the vulnerability exists in EmberZNet v9.0.2 and earlier. However, the corpus does not provide explicit information on the affected scope or remediation steps. Defenders should verify the vulnerability's impact on their systems and review the official advisory or CVE record for further guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.