Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier

Vulnerability

A buffer overflow vulnerability exists in the Silicon Labs Ember ZNet stack, which is part of the Gecko SDK (GSDK) [1]. The issue is classified as an Improper Restriction of Operations within the Bounds of a Memory Buffer, allowing overflow of buffers. The specific affected versions are not disclosed in the available references.

Exploitation

The exact exploitation steps are not publicly detailed. However, as a buffer overflow, an attacker would likely need to send a specially crafted network packet or input to a device running the vulnerable Ember ZNet stack. The attacker may require network access to the target device.

Impact

Successful exploitation of this buffer overflow could allow an attacker to corrupt memory, potentially leading to arbitrary code execution or denial of service. The impact depends on the context of the affected device.

Mitigation

No specific fix version has been published in the available references. Users should update to the latest version of the Gecko SDK from the official repository [1] and apply any security patches released by Silicon Labs. Monitor the vendor's security advisories for further information.