CVE-2022-39064 - CVE House
Back to Database
Status published Unknown CVE-2022-39064

An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame...

Vulnerability Description

An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple times, the bulb performs a factory reset. This causes the bulb to lose configuration information about the Zigbee network and current brightness level. After this attack, all lights are on with full brightness, and a user cannot control the bulbs with either the IKEA Home Smart app or the TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score 7.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39064

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ikea

View All →
CVE-2022-39065
A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI...
Unknown 0

Affected Vendor

Affected Software

TRÅDFRI smart lighting system
Vulnerable Versions:
< 2.0.029 >

Timeline

Official Publish: October 14th, 2022
Last Modified: May 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-241

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.