CVE-2026-47154: Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2
In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47154?
CVE-2026-47154 has a risk score of 27, indicating a moderate severity concern.
How do I fix CVE-2026-47154?
To mitigate CVE-2026-47154, update EmberZNet to version 9.0.3 or later, which resolves the vulnerability.
What systems are affected by CVE-2026-47154?
CVE-2026-47154 affects EmberZNet v9.0.2 and earlier versions.
What type of vulnerability is CVE-2026-47154?
CVE-2026-47154 is an out-of-bounds read vulnerability triggered by malformed GetProfileResponse messages.
Can CVE-2026-47154 lead to information leakage?
No information leakage back to the sender was observed with CVE-2026-47154.