This vulnerability (CWE-787) in EmberZNet up to version 9.0.2 allows an attacker with network access and privileges of a joined device to send malformed ClearWeekdaySchedule messages. These messages cause out-of-bounds writes into the Door Lock schedule state memory area. The size and location of the corrupted data are limited, and only devices implementing the Door Lock cluster are affected. No official patch or remediation level has been published by Silicon Labs as of the data provided.

Successful exploitation could lead to memory corruption in the Door Lock schedule state, potentially causing denial of service or other unpredictable behavior on affected devices. The vulnerability requires the attacker to have joined the network, limiting remote exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Silicon Labs advisories for updates. Restricting network access to trusted devices and limiting devices that support the Door Lock cluster may reduce exposure.