This vulnerability in EmberZNet (<=9.0.2) allows an attacker with network access and privileges to send malformed Door Lock user identifiers that cause out-of-bounds reads in a table, leading to process termination (denial of service). The flaw is categorized as CWE-125 (Out-of-bounds Read). Exploitation requires the attacker device to be part of the network and support the Door Lock cluster. There is no evidence of information leakage or further compromise beyond process termination.

Successful exploitation results in denial of service by terminating the affected process on devices supporting the Door Lock cluster. No data leakage or privilege escalation has been observed. The vulnerability requires the attacker to have joined the network, limiting exposure to internal or compromised devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to trusted devices only, especially those supporting the Door Lock cluster, to reduce risk. Monitor for unusual process terminations on affected devices.