CVE-2025-7964CWE-229

Zigbee Router Denial of Service

Critical · published January 30, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

After receiving a

malformed 802.15.4 MAC Data Request

the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices will be unable to rejoin. A manual recommissioning is required to recover the Zigbee Router.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
EPSS
0.00293 · 20.8th percentile
Weakness
CWE-229 · Improper Handling of Values
Published
2026-01-30T15:02Z
EPSS history
Timeline
  • 30 JAN 15:02Z
    Zigbee Router Denial of Service
    cvelistv5