Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-66282

Authenticated Denial-of-Service in Zigbee Publish Billing Period

Description

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Silicon Labs EmberZNet

Default version status: unaffected

  • 0 to ≤ 9.1.1affected

References