CVE-2026-66281: CWE-835 Loop with unreachable exit condition ('infinite loop') in Silicon Labs EmberZNet
Description
CVE-2026-66281 is a medium severity vulnerability in Silicon Labs EmberZNet versions up to 9.1.1. It involves an infinite loop triggered by a malformed Discover Attributes command from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are affected.
CVSS v4.0
Score 6.0medium
Affected software
Silicon Labs
EmberZNet
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In EmberZNet versions 9.1.1 and earlier, a malformed Discover Attributes command can cause the software to enter a loop with an unreachable exit condition, effectively an infinite loop. This vulnerability affects only devices that have joined the network and support manufacturer-specific clusters. The issue is classified under CWE-835 (Loop with unreachable exit condition). The CVSS 4.0 base score is 6.0, indicating medium severity. No known exploits in the wild or vendor patch information is provided in the input data.
Potential Impact
The vulnerability can cause the affected device to become unresponsive due to an infinite loop when processing a malformed Discover Attributes command. This could lead to denial of service conditions on the impacted device. The impact is limited to devices supporting manufacturer-specific clusters and that have already joined the network.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to trusted devices only and monitor for malformed Discover Attributes commands from devices within the network.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Silabs
- Date Reserved
- 2026-07-24T13:33:53.357Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ada17294d27ba8daa5b44b5
Added to database: 10/22/2026, 14:01:13 UTC
Last enriched: 10/22/2026, 14:15:34 UTC
Last updated: 10/22/2026, 17:15:46 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.