This vulnerability (CWE-125) in EmberZNet up to version 9.0.2 allows an attacker with network access and privileges of a joined device to send malformed GetGroupMembership commands that cause out-of-bounds reads beyond the message payload. This results in process termination (crash). The flaw affects only devices supporting the Groups cluster. There is no evidence of information leakage to the attacker. The CVSS 4.0 base score is 7.1, indicating high severity. No official patch or remediation level has been published by Silicon Labs as of the data provided.

Successful exploitation causes the affected device process to terminate due to out-of-bounds reads, resulting in denial of service. No information leakage or privilege escalation has been observed. The impact is limited to devices supporting the Groups cluster and requires the attacker to be a device already joined to the network.

No official patch or remediation has been published by Silicon Labs yet. Users should monitor vendor advisories for updates. Until a fix is available, restricting network access to trusted devices and limiting the ability of joined devices to send malformed GetGroupMembership commands may reduce risk. No information leakage or privilege escalation mitigations are necessary based on current data.