← Vulnerability feed

Vulnerability record · CVE-2022-24938 · published 14 November 2022

CVE-2022-24938: Silabs emberznet memory buffer overflow vulnerability

SSilabs · Emberznet

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

7.5 CVSS 3.1 High EPSS 0.75% · top 47.0% CWE-119 · Memory buffer overflowCWE-787 · Out-of-bounds write
7.5CVSS 3.1 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/SiliconLabs/gecko_sdk Not Applicable
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000HbLj2QAF?operationContext=S1 Permissions RequiredVendor Advisory
https://github.com/SiliconLabs/gecko_sdk Not Applicable
https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000HbLj2QAF?operationContext=S1 Permissions RequiredVendor Advisory

Track CVE-2022-24938 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-51392Silabs emberznet broken cryptographic algorithm vulnerabilityEmber ZNet between v7.2.0 and v7.4.0 used software AES-CCM instead of integrated hardware cryptographic accelerators, potentially increasing risk of …EPSS 0.24%9.8CVE-2023-41094Silabs emberznet vulnerabilityTouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effec…EPSS 0.58%9.8CVE-2022-24937Silabs emberznet memory buffer overflow vulnerabilityImproper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers.EPSS 0.69%7.5CVE-2023-51393Silabs emberznet allocation without limits vulnerabilityDue to an allocation of resources without limits, an uncontrolled resource consumption vulnerability exists in Silicon Labs Ember ZNet SDK prior to v…EPSS 0.52%7.5CVE-2023-51394Silabs emberznet null pointer dereference vulnerabilityHigh traffic environments may result in NULL Pointer Dereference vulnerability in Silicon Labs's Ember ZNet SDK before v7.4.0, causing a system crash.EPSS 0.52%7.1CVE-2026-4526Silabs emberznet out-of-bounds read vulnerabilityIn EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. …EPSS 0.44%7.1CVE-2026-47149Silabs emberznet out-of-bounds read vulnerabilityIn EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process…EPSS 0.44%7.1CVE-2026-47150Silabs emberznet out-of-bounds write vulnerabilityIn EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The…EPSS 0.38%

Source: NIST National Vulnerability Database (record CVE-2022-24938), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.