CVE-2026-66282

6.0 Moyenne

Publiée le 22/10/2026 à 16:17 · Modifiée le 22/10/2026 à 16:17 · Reçue · Source : product-security@silabs.com

Description

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

Traduire en français

Produits concernés

Silicon Labs EmberZNet

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.0 Moyenne	product-security@silabs.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-674

Références

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.md

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories