Skip to content
OpenAdvisories
Medium ICSA-26-027-03 5 CVEs

Schneider Electric Zigbee Products

Published Jan 13, 2026 · Updated Jan 27, 2026 · Revision 2

Vendor: Schneider Electric Product: Connected Double Socket Outlet Product: Connected Single Socket Outlet Product: Connected Wireless Switch Product: Elko cFMT 16a Product: Exxact cFMT 16a Product: Fuga Connected Socket Outlet Product: Iconic, Connected AC Fan Controller Product: Iconic, Connected Smart Socket Product: Iconic, Wiser Connected Smart Dimmer Product: Iconic, Wiser Connected Smart Switch, 10AX Product: Iconic, Wiser Connected Smart Switch, 2AX Product: Merten cFMT 16a Product: Merten cFMT 2a Product: Micromodule Dimmer Product: Micromodule Shutter Product: Micromodule Switch Product: Mureva EV Link Product: Odace cFMT 2a Product: Wiser 16A Electrical Heat Switch Product: Wiser Boiler Relay Product: Wiser Connected Application Module 1-Gang Product: Wiser Connected Application Module 2-Gang Product: Wiser Connected Motion Dimmer Product: Wiser Connected Motion Switch Product: Wiser Connected Push Button Dimmer Product: Wiser Connected Push Button Shutter Product: Wiser Connected Push Button Switch Product: Wiser Connected Rotary Dimmer Product: Wiser FIP Micromodule +5 more

Summary

Schneider Electric is aware of multiple vulnerabilities with EmberZNet disclosed by Silicon Labs.
Many vendors, including Schneider Electric, use Silicon Labs’ Zigbee processors in their offers.
The following have denial of service vulnerabilities: Wiser iTRV, Wiser RTR, Wiser UFH, Wiser
Heat Switch, Wiser Boiler Relay, cFMT (Exaact, Elko, Odace, Merten), Wiser Micromodule,
Iconic Wiser Connected Smart Dimmer, Iconic Zigbee devices, Wiser Application Modules,
Wiser Connected Pushbutton Switch/Dimmer/Shutter controller, Rotary Dimmer, Motion Sensor
Dimmer/Switch, Smart socket outlets, and EV socket outlet. See the following table.
Failure to apply the mitigations provided below may risk denial of service, which could result in
products being unavailable.

Vulnerabilities 5

  • Medium 6.5
    CVE-2024-6350

    EmberZNet malformed MAC layer packet leads to denial of service

    A malformed 802.15.4 packet causes a buffer overflow to occur leading to an assert and a denial of service. A watchdog reset clears the error condition automatically.

    silabs.com Simplicity SDK
  • Medium 5.8
    CVE-2024-7322

    Dos in ZigBee device due to unsolicited encrypted rejoin response

    A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established

    silabs.com EmberZNet
  • Medium 4.3
    CVE-2024-6351

    Malformed packet leads to denial of service in NWK/APS layer

    A malformed packet can cause a buffer overflow in the NWK/APS layer of the Ember ZNet stack and lead to an assert

    silabs.com SiSDK
  • Medium 4.3
    CVE-2024-6352

    Malformed packet leads to denial of service in APS layer

    A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert

    silabs.com SiSDK
  • Low 3.7
    CVE-2024-10106

    Ember ZNet buffer overflow in 'packet handoff' plugin

    A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer.

    silabs.com Ember ZNet SDK

Revision history

  1. #2

    Initial Republication of Schneider Electric CPCERT SEVD-2026-013-03 advisory

  2. #1

    Original Release

References