PatchTheCVEemberznet vulnerabilities and fixes
Recent CVEs affecting emberznet, with upgrade or downgrade steps. 11 tracked.
emberznet has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-06-25. Highest priority: CVE-2026-47147 (score 33/100).
- CVE-2026-47147 HIGH 7.1 UPGRADE In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds rea
- CVE-2026-47150 HIGH 7.1 UPGRADE In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-tab
- CVE-2026-47151 HIGH 7.1 UPGRADE In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into
- CVE-2026-47145 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the proce
- CVE-2026-47146 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the proce
- CVE-2026-47148 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end
- CVE-2026-47149 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bound
- CVE-2026-47152 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a di
- CVE-2026-47153 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a di
- CVE-2026-47154 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while
- CVE-2026-4526 MEDIUM 6.5 UPGRADE In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework pa
FAQ
How do I fix emberznet vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is emberznet being exploited right now?
None of the tracked emberznet CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which emberznet CVE should I patch first?
CVE-2026-47147 currently ranks highest (33/100): In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds rea.