CVE-2026-47152 Silicon Labs CVE debrief

Who should care

Defenders responsible for IoT devices and networks that use EmberZNet should assess exposure and potential impact. They should verify exposure of Level Control cluster devices on their network, assess the potential impact of a malformed Level Control Move command, and monitor network activity for suspicious Level Control Move commands. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-47152 because it affects EmberZNet, which is used in IoT devices. A malformed Level Control Move command can terminate the process, potentially impacting device functionality. Defenders should verify exposure, assess potential impact, and monitor network activity.

• Verification of exposure for Level Control cluster devices
• Potential process termination due to divide-by-zero fault
• Monitoring network activity for suspicious Level Control Move commands

Technical summary

A malformed Level Control Move command can terminate the process through a divide-by-zero fault in EmberZNet v9.0.2 and earlier. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. The vulnerability affects IoT devices that use EmberZNet, potentially impacting device functionality. Defenders should prioritize verifying exposure of Level Control cluster devices on their network and assess the potential impact of a malformed Level Control Move command.

Defensive priority

Defenders should prioritize verifying exposure of Level Control cluster devices on their network and assess the potential impact of a malformed Level Control Move command.

Recommended defensive actions

• Verify exposure of Level Control cluster devices on the network
• Assess the potential impact of a malformed Level Control Move command
• Monitor network activity for suspicious Level Control Move commands
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, but do not specify which versions are fixed or provide additional details on exploitation. The source reference also does not provide further details on affected scope or vendor guidance. Defenders should verify exposure of Level Control cluster devices on their network and assess the potential impact of a malformed Level Control Move command.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.