CVE-2026-66281— Authenticated Denial-of-Service in Zigbee Discover Attributes Handling
Quick assessment
Affected
Silicon Labs EmberZNet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 EmberZNet 9.1.1 及更早版本中，畸形的“发现属性”（Discover Attributes）命令可能导致程序陷入无法退出的循环（即无限循环）。此类消息必须源自已加入网络的设备。仅支持厂商特定簇（manufacturer-specific clusters）的设备会受到此漏洞影响。
Possible ATT&CK Techniques 2 AI
T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authenticated Denial-of-Service in Zigbee Discover Attributes Handling
Source: CVE Program / CVE List V5
Vulnerability Description
In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Silicon Labs | EmberZNet | 0 ~ 9.1.1 | - |
|
II. Public POCs for CVE-2026-66281
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66281
请登录查看更多情报信息。
Other References for CVE-2026-66281 (1)
Same Patch Batch · Silicon Labs · 2026-10-22 · 8 CVEs total
| CVE-2026-94502 | 7.5 HIGH | Out-of-bounds write in Zigbee Publish Price Matrix handling |
| CVE-2026-85079 | 7.5 HIGH | Out-of-bounds write in Zigbee Simple_Desc_req handling |
| CVE-2026-66279 | 7.2 HIGH | Dis-connect vulnerability in Connect Stack |
| CVE-2026-85080 | 6.0 MEDIUM | Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling |
| CVE-2026-66282 | 6.0 MEDIUM | Authenticated Denial-of-Service in Zigbee Publish Billing Period |
| CVE-2026-89409 | 5.3 MEDIUM | Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes |
| CVE-2026-89410 | 5.1 MEDIUM | Out-of-bounds read in Z-Wave NCP SPI Handler |
IV. Related Vulnerabilities
Same product: EmberZNet
-
CVE-2026-85079
Out-of-bounds write in Zigbee Simple_Desc_req handling -
CVE-2026-94502
Out-of-bounds write in Zigbee Publish Price Matrix handling -
CVE-2026-66282
Authenticated Denial-of-Service in Zigbee Publish Billing Pe -
CVE-2026-85080
Authenticated Denial-of-Service in Zigbee GetGroupMembership -
CVE-2026-6432
Improper bounds validation in EmberZNet SDK
Same vendor: Silicon Labs
-
CVE-2026-89410
Out-of-bounds read in Z-Wave NCP SPI Handler -
CVE-2026-89409
Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End -
CVE-2026-85079
Out-of-bounds write in Zigbee Simple_Desc_req handling -
CVE-2026-94502
Out-of-bounds write in Zigbee Publish Price Matrix handling -
CVE-2026-66282
Authenticated Denial-of-Service in Zigbee Publish Billing Pe
Same weakness: CWE-835
-
CVE-2026-110354
HAProxy 3.4.6 前版本 HTTP/1.1 分块拒绝服务漏洞 -
CVE-2026-96642
Pillow: TarIO negative size field causes infinite CPU-spin l -
CVE-2026-76445
Multiple Cisco Products Snort 3 Denial of Service Vulnerabil -
CVE-2026-20019
Multiple Cisco Products Snort 3 Netflow Denial of Service Vu -
CVE-2026-113794
pypdf: Possible infinite loop when hitting EOF in standard x
V. Comments for CVE-2026-66281
No comments yet