In EmberZNet versions up to and including 9.0.2, malformed Color Control cluster messages originating from devices that have joined the network can trigger reachable assertions. These assertions cause the affected process to terminate, potentially disrupting device operation. The vulnerability is classified as CWE-617 (Reachable Assertion) and has a CVSS 4.0 base score of 7.1, indicating high severity. No official patch or remediation level has been published by Silicon Labs as of the data available.

Successful exploitation of this vulnerability results in process termination on affected devices, leading to denial of service conditions. Only devices supporting the Color Control cluster and receiving malformed messages from authorized network devices are impacted. There is no indication of privilege escalation, data disclosure, or remote code execution from the provided information.

No official patch or remediation guidance has been published by Silicon Labs at this time. Users should monitor vendor advisories for updates. Since the vulnerability requires messages from devices already joined to the network, restricting network access to trusted devices may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.