CVE-2025-7964

Executive Summary

CVE-2025-7964 is a critical denial-of-service vulnerability in Silicon Labs Zigbee router implementations, carrying a CVSS score of 9.2. An unauthenticated attacker can send a malformed 802.15.4 MAC Data Request frame to the Zigbee Coordinator, which triggers the coordinator to issue a 'network leave' command to a Zigbee router, permanently disabling the router from rejoining the network until manual recommissioning is performed.

The vulnerability affects Zigbee mesh networks relying on Silicon Labs Zigbee router firmware, causing cascading availability loss: the affected router disconnects, and its associated end devices lose their parent router. The vulnerability requires no authentication and no user interaction, and is remotely exploitable over the air within Zigbee radio range. With an EPSS score of 0.00276 (19.8th percentile), the exploit is not yet widely observed in the wild; however, public PoC availability and the lack of any patch make this a critical risk for organizations operating Zigbee deployments.

Technical Analysis

The vulnerability resides in the Zigbee Coordinator's handling of malformed 802.15.4 MAC-layer Data Request frames. The 802.15.4 standard defines the MAC frame structure, where a Data Request command is used by an associated device to poll its parent for pending data. The vulnerability mechanism is described as follows:

1. An attacker transmits a malformed 802.15.4 MAC Data Request frame within radio range of a Zigbee Coordinator.
2. The Zigbee Coordinator fails to properly validate the frame contents (CWE-20 — Improper Input Validation).
3. Instead of discarding the malformed frame or handling it gracefully, the coordinator responds by sending a 'network leave' request to a Zigbee router.
4. The Zigbee router processes the leave request and enters a non-rejoinable state — it is effectively removed from the network and cannot rejoin.

The attack surface is the 802.15.4 wireless link — Zigbee operates on IEEE 802.15.4 at 2.4 GHz (and sub-GHz in some regions), with typical indoor radio ranges of 10–30 meters. No authentication, credentials, or network access are required; the attacker only needs a Zigbee-capable radio transceiver capable of crafting raw 802.15.4 frames.

From a code-level perspective, the NVD description does not provide specific function names, file paths, or parameter identifiers. The vulnerability class is improper input validation within the network-layer frame parsing logic of the Zigbee Coordinator stack (likely the EmberZNet stack or Zigbee Cluster Library implementation on Silabs hardware). The malformed frame likely causes the coordinator's parsing routine to misinterpret a field or fail a length/type check, leading to the anomalous leave-request behavior.

The "non-rejoinable" state is a critical detail: normal Zigbee routers can rejoin after a temporary disconnect, but this flaw leaves the router permanently stuck, forcing a manual recommissioning (e.g., physically pressing a reset button or re-pairing via a network tool). During the outage window, all end devices that relied on the affected router as their parent will be unable to rejoin unless an alternate parent is available — a condition that frequently fails in dense or edge deployments.

Exploitation Scenarios

The attack chain for CVE-2025-7964 is derived from the NVD description and operates at the Zigbee protocol layer.

Step 1: Reconnaissance / Target Identification The attacker scans the 2.4 GHz band for Zigbee networks using a tool such as a packet sniffer with an 802.15.4 radio (e.g., Texas Instruments CC2531 dongle, Nordic nRF52840, or Ubertooth). By passively capturing beacons and network discovery frames, the attacker identifies:

• Zigbee Coordinator PAN ID and extended PAN ID
• Channel in use
• Zigbee router devices in the network (via route-discovery frames and association records)
• The coordinator's MAC address (short and extended)

Target selection typically focuses on networks where end devices (sensors, actuators) depend on a single router for connectivity — common in smart-home, industrial IoT, and building-automation deployments.

Step 2: Flaw Trigger The attacker crafts a malformed 802.15.4 MAC Data Request frame and transmits it to the Zigbee Coordinator. The frame is deliberately constructed to fail validation checks in the coordinator's frame-parsing logic. Possible malformations (at the vulnerability-class level) include:

• Incorrect frame length field (FCF or payload length mismatch)
• Invalid or reserved addressing modes in the frame control field
• Malformed payload content in the Data Request command
• Sequence-number inconsistencies

The exact byte-level structure of the triggering frame is not specified in the NVD description; however, the public PoC availability implies the malformed frame structure has been reverse-engineered and documented. The key condition is that the coordinator fails to reject the frame, instead processing it through its normal Data Request handling path and emitting the network-leave command.

Step 3: Payload / Execution Method No code execution payload is used. The attack is purely protocol-level — the malformed frame acts as the "payload" that induces the coordinator to send a valid Zigbee network-leave command (Mgmt_Leave_req) to a targeted router. The leave command is authenticated at the network layer, but the coordinator itself issues it, so the frame passes all cryptographic checks. The attacker exploits the coordinator's flawed parsing to achieve an authenticated action (network ejection) without possessing any network keys.

Step 4: Post-Exploitation Impact Once the router receives the leave request and disconnects:

• The router enters a permanently non-rejoinable state; it will not automatically reconnect.
• All end devices previously associated with that router lose their parent.
• End devices attempt to rejoin via other routers; if no suitable parent exists, they remain orphaned and non-functional.
• Manual recommissioning (physical or tool-based) is required to restore the router — a time-consuming process in large deployments.
• An attacker can repeat the process against multiple routers, systematically dismantling the Zigbee mesh network.

No lateral movement or data exfiltration is possible; the impact is strictly availability (network availability for the affected router and its child devices). No CISA KEV listing, no Nuclei template, and no exploit code are publicly available, though the PoC is marked "Public."

Impact Assessment

CVSS Breakdown (derived from vector): CVSS 9.2 (Critical) with AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), S:U (unchanged scope), C:N/I:N/A:H (no confidentiality or integrity impact; high availability impact).

Business Impact: The primary risk is operational disruption. Organizations relying on Zigbee for building automation (HVAC, lighting control), smart-metering infrastructure, industrial sensing, or healthcare monitoring face:

• Extended downtime for portions of the wireless sensor network.
• Manual recovery effort requiring physical access to routers.
• Cascading failures as orphaned end devices drain batteries retrying rejoin attempts.
• Reduction in situational awareness if sensor data becomes unavailable.

Affected Systems: Zigbee router devices based on Silicon Labs Zigbee platforms (EFR32MG series, EmberZNet stack). The Zigbee Coordinator itself is the trigger, but the impact is concentrated on the router and its child end devices. The exact affected firmware versions are not disclosed in the available data.

Blast Radius: The attack spans the wireless range of 802.15.4 — typically 10–30 meters indoors and up to 100 meters line-of-sight. In a dense mesh, a single malformed frame can disrupt one router and its subtree of end devices; repeated frames can cripple an entire network zone. The high CVSS score reflects the trivial exploitation (no auth, no complexity) against a high-availability impact.

Detection Guidance

Note: Detection of this vulnerability is challenging because Zigbee traffic is encrypted at the network layer, and the malformed frame is transmitted over the air. Most enterprise security tooling (SIEM, IDS) does not natively inspect 802.15.4 traffic. The following rules are written for environments with Zigbee-adjacent telemetry (e.g., network controllers that log Zigbee association events, or edge gateways that convert Zigbee data to IP traffic).

Sigma Rule

title: Zigbee Router Network Leave Request - Potential CVE-2025-7964
id: 9f2c4b8e-1a33-4d7e-9f6b-0e5c8a2f3d41
status: experimental
description: Detects repeated or anomalous network-leave requests issued by a Zigbee Coordinator, potentially indicating exploitation of CVE-2025-7964.
author: Valtersit Threat Intel
date: 2025/01/01
logsource:
    product: zigbee
    service: coordinator
detection:
    selection:
        event_type: "network_leave"
        command_source: "coordinator"
    timeframe: 5m
    condition: selection | count() by target_router > 1
level: high
falsepositives:
    - Legitimate network administrative actions removing routers
    - Normal rekeying or maintenance operations
fields:
    - target_router
    - coordinator_id
    - timestamp

YARA Rule

rule Zigbee_CVE_2025_7964_Malformed_Data_Request
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects byte patterns consistent with malformed 802.15.4 MAC Data Request frames used in CVE-2025-7964 exploitation"
        date = "2025-01-01"
        reference = "CVE-2025-7964"
        cve = "2025-7964"
    strings:
        // Data Request command frame control: 0x0044 (data, no security, ACK request)
        $fc_data_req = { 44 00 }
        // Malformed short address patterns (all zeros or broadcast)
        $mal_addr_short = { 00 00 }
        $mal_addr_broadcast = { FF FF }
        // Abnormally short payload lengths for Data Request
        $short_len1 = { 05 }  // total frame length 5 bytes (too short)
        $short_len2 = { 04 }
    condition:
        $fc_data_req at 0 and
        (($mal_addr_short at 3) or ($mal_addr_broadcast at 3)) and
        ($short_len1 or $short_len2)
}

Suricata IDS Rule

# Note: Suricata does not natively decode 802.15.4. This rule targets IP-layer
# telemetry from Zigbee gateways/coordinators that log management events.
alert ip any any -> any any (msg:"CVE-2025-7964 Zigbee Router Network Leave Event"; flow:to_server; content:"network_leave"; nocase; content:"router"; distance:0; within:50; classtype:attempted-dos; sid:20257964; rev:1;)

Elastic Detection

// Assumes Zigbee coordinator telemetry is indexed in Elasticsearch
sequence by host.id with maxspan=5m
  [ network where event.action == "zigbee_data_request" and network.protocol == "zigbee" ]
  [ network where event.action == "network_leave" and network.direction == "egress" ]

Splunk SPL Query

index=zigbee_coordinator sourcetype=zigbee:events
| where event_type="network_leave" AND command_source="coordinator"
| stats count by target_router, coordinator_id, _time
| where count > 1
| table _time, coordinator_id, target_router, count

Wazuh OSSEC Rule

<group name="zigbee,">
  <rule id="100796" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">network_leave</field>
    <field name="command_source">coordinator</field>
    <description>CVE-2025-7964: Zigbee Coordinator issued network-leave to router (potential DoS exploitation)</description>
    <group>zigbee_dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — no patch evidence from any tracked source (confidence 0/4). Silicon Labs has not released a firmware update, and no vendor advisory or CVE-2025-7964-specific fix is publicly available.

Immediate Mitigations (within 24–72 hours):

1. Radio segmentation: Implement separation between Zigbee coordinator/router networks and untrusted physical spaces; restrict physical access to areas within 802.15.4 radio range (30–100 m) where possible.
2. Network monitoring: Enable Zigbee coordinator logging for all network-leave/Mgmt_Leave events; alert on any network-leave request that is not initiated by legitimate administrative tools.
3. Rate limiting: If the coordinator firmware allows it, restrict the rate of Data Request processing or add validation logic that rejects anomalous frames.
4. Backup routers: Deploy redundant Zigbee routers in critical areas so orphaned end devices can rejoin an alternate parent without manual intervention.

Patch/Upgrade Steps:

• Monitor Silicon Labs EmberZNet/Zigbee release notes and security advisories (available at silabs.com/security) for a firmware update.
• Apply the vendor patch immediately upon release; validate in a staging Zigbee network before production deployment.
• Register for Silicon Labs security notification mailing lists to receive CVE-specific advisories.

Long-Term Hardening:

• Implement Zigbee network-level security best practices: enable network and link-layer encryption, rotate network keys periodically, and use install codes for device authentication.
• Deploy Zigbee 3.0-compliant devices and firmware; older Zigbee Pro stacks may have additional parsing weaknesses.
• Segment Zigbee networks from corporate IT networks; ensure the coordinator/gateway does not expose management interfaces to untrusted IP networks.
• Conduct regular security assessments of Zigbee airspace (spectrum audits) with 802.15.4 packet capture tools to detect anomalous frames.
• If Zigbee is non-essential, consider migrating to standards with more mature security postures (e.g., Thread/Matter) where coordinated patching is more reliable.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-7964 — official CVE record, CVSS vector, and description.
2. Silicon Labs Security Portal: https://www.silabs.com/security — vendor security advisories and firmware update notifications (check for CVE-2025-7964-specific advisory).
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2025-7964 is NOT listed (as of report date), indicating no confirmed exploitation in the wild.
4. EPSS (Exploit Prediction Scoring System): https://www.first.org/epss/ — EPSS score 0.00276, 19.8th percentile, indicating low current likelihood of exploitation in the wild.

Threat Actor / Exploit-in-the-Wild Notes: No known threat-actor campaigns have been publicly attributed to CVE-2025-7964 as of the report date. The vulnerability has a "Public" PoC status, meaning proof-of-concept code or a documented exploitation method is available, though no dedicated exploit code or Nuclei template exists. The low EPSS percentile suggests that although exploitation is possible, it is not being actively pursued in mass-campaign fashion — likely due to the niche nature of Zigbee radio exploitation requiring specialized hardware and proximity.