After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices will be unable to rejoin. A manual recommissioning is required to recover the Zigbee Router.
The attacker sends a specially crafted (malformed) MAC Data Request frame compliant with the 802.15.4 standard to the Zigbee Coordinator. The Coordinator misinterprets this frame and in response sends a network leave request to the Zigbee Router. The router enters a state in which it cannot rejoin the network (non-rejoinable state). If there is no appropriate parent node, end devices also lose the ability to rejoin the network.
An attacker can remotely and without authentication cause permanent unavailability of a Zigbee Router and the end devices connected to it. Restoring network functionality requires manual reconfiguration (recommissioning) of the affected router.
Patches available from the manufacturer should be applied according to the references (https://community.silabs.com/068Vm00000dspiL). Until the fix is implemented, it is recommended to restrict physical and network access to Zigbee devices and monitor 802.15.4 traffic for anomalies.
Silicon Labs products using the Zigbee stack with 802.15.4 protocol support — versions indicated in the manufacturer's references
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X