CVE-2026-47148
Last modified
CVE-2026-47148 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Silabs | Emberznet | <= 9.0.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-47148?
How severe is CVE-2026-47148?
How do I fix CVE-2026-47148?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47141vm2 is an open source vm/sandbox for Node.js. Prior to versi…6.9
- CVE-2026-47143Capstone is a disassembly framework. Versions prior to 6.0.0…5.9
- CVE-2026-47144Shamefile is a linter for undocumented linter warnings. Prio…5.5
- CVE-2026-47145In EmberZNet v9.0.2 and earlier, malformed Color Control mes…6.5
- CVE-2026-47146In EmberZNet v9.0.2 and earlier, malformed Color Control mes…6.5
- CVE-2026-47147In EmberZNet v9.0.2 and earlier, malformed OTA requests can …7.1
- CVE-2026-47149In EmberZNet v9.0.2 and earlier, malformed or out-of-range D…6.5
- CVE-2026-4715Uninitialized memory in the Graphics: Canvas2D component. Th…9.1
- CVE-2026-47150In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollme…7.1
- CVE-2026-47151In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySched…7.1
- CVE-2026-47152In EmberZNet v9.0.2 and earlier, a malformed Level Control M…6.5
- CVE-2026-47153In EmberZNet v9.0.2 and earlier, a malformed Level Control S…6.5
Are you affected by CVE-2026-47148?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST