7.1
High
CVE-2026-47147 In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads
Description
In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EmberZNet 9.0 | earliest → 9.0.2 | No fix stated |
Other CVEs of EmberZNet
The 17 CVEs of EmberZNet →
CVE-2026-85079
In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially…
7.5
High
CVE-2026-94502
In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write…
7.5
High
CVE-2026-66282
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call…
6.0
Medium
CVE-2026-66281
In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit…
6.0
Medium