CVE-2026-66281: Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

Q: Which deployments are exposed to this issue?

Deployments using EmberZNet 9.1.1 or earlier are affected only if devices support manufacturer-specific clusters. Devices without support for those clusters are not impacted.

Q: What access does an attacker need to trigger the denial of service?

The malformed Discover Attributes command must originate from a device that has already joined the Zigbee network. This is therefore not exploitable by an unauthenticated device that has not joined the network.

Published Oct 22, 2026

Updated

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.

Affected Software

1 affected component

Silicon Labs EmberZNet<=9.1.1

Event History

Oct 22, 2026

CVE Published

via MITRE·01:43 PM

Data Sourced

via MITRE·01:43 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using EmberZNet 9.1.1 or earlier are affected only if devices support manufacturer-specific clusters. Devices without support for those clusters are not impacted.

What access does an attacker need to trigger the denial of service?

The malformed Discover Attributes command must originate from a device that has already joined the Zigbee network. This is therefore not exploitable by an unauthenticated device that has not joined the network.