CVE-2026-66282: Authenticated Denial-of-Service in Zigbee Publish Billing Period
In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Only EmberZNet deployments with devices that support the Zigbee Price Cluster are impacted. The affected versions are EmberZNet 9.1.1 and earlier.
What access does an attacker need to trigger the issue?
The attacker must be able to send a malformed Publish Billing Period command from a device that has already joined the Zigbee network. The data does not indicate that an unauthenticated or unjoined device can exploit it.
What is the expected effect of a successful exploit?
The malformed command causes a recursive function call that never reaches its end condition, resulting in denial of service.