ID
VAR-202201-0275
CVE
CVE-2020-9059
TITLE
Silicon Labs Z-Wave chipsets contain multiple vulnerabilities
Trust: 0.8
DESCRIPTION
Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaustion. As an example, the Schlage BE468 version 3.42 door lock is vulnerable and fails open at a low battery level. Various Silicon Labs Z-Wave chipsets do not support encryption, can be downgraded to not use weaker encryption, and are vulnerable to denial of service. Some of these vulnerabilities are inherent in Z-Wave protocol specifications.CVE-2020-10137 Unknown CVE-2020-9057 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data. CVE-2020-9058 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data. CVE-2020-9059 Affected Vendor Statement: This is a known weakness with S0 security. CVE-2020-9060 Affected Vendor Statement: This is a known weakness with S2 security. CVE-2020-9061 Affected Vendor Statement: This is a known weakness with S0 and S2 security.CVE-2020-10137 Unknown CVE-2020-9057 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data. CVE-2020-9058 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data. CVE-2020-9059 Affected Vendor Statement: This is a known weakness with S0 security. CVE-2020-9060 Affected Vendor Statement: This is a known weakness with S2 security. CVE-2020-9061 Affected Vendor Statement: This is a known weakness with S0 and S2 security
Trust: 2.43
AFFECTED PRODUCTS
| vendor: | silabs | model: | 500 series | scope: | eq | version: | * | Trust: 1.0 |
| vendor: | schlage | model: | be468 | scope: | eq | version: | 3.42 | Trust: 1.0 |
| vendor: | silicon | model: | 500 シリーズ | scope: | - | version: | - | Trust: 0.8 |
| vendor: | schlage | model: | be468 | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-400 | Trust: 1.1 |
| problemtype: | CWE-770 | Trust: 1.1 |
| problemtype: | Allocation of resources without limits or throttling (CWE-770) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote or local
Trust: 0.6
TYPE
resource management error
Trust: 0.6
PATCH
| title: | Top Page Silicon Labs, Inc.Silicon Labs, Inc. | url: | https://www.schlage.com/en/home.html | Trust: 0.8 |
| title: | Silicon Labs Z-Wave Chipsets Remediation of resource management error vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=178622 | Trust: 0.6 |
| title: | VFuzz-public | url: | https://github.com/CNK2100/VFuzz-public | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-9059 | Trust: 4.2 |
| db: | CERT/CC | id: | VU#142629 | Trust: 3.3 |
| db: | JVN | id: | JVNVU94598199 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2021-017816 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202201-579 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-187184 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2020-9059 | Trust: 0.1 |
REFERENCES
| url: | https://github.com/cnk2100/vfuzz-public | Trust: 2.6 |
| url: | https://kb.cert.org/vuls/id/142629 | Trust: 2.5 |
| url: | https://ieeexplore.ieee.org/document/9663293 | Trust: 2.5 |
| url: | https://www.kb.cert.org/vuls/id/142629 | Trust: 1.7 |
| url: | https://doi.org/10.1109/access.2021.3138768 | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-9059 | Trust: 1.4 |
| url: | http://jvn.jp/vu/jvnvu94598199/index.html | Trust: 0.8 |
CREDITS
This document was written by Timur Snoke and Art Manion.Statement Date: June 30, 2020
Trust: 0.8
SOURCES
| db: | CERT/CC | id: | VU#142629 |
| db: | VULHUB | id: | VHN-187184 |
| db: | VULMON | id: | CVE-2020-9059 |
| db: | JVNDB | id: | JVNDB-2021-017816 |
| db: | CNNVD | id: | CNNVD-202201-579 |
| db: | NVD | id: | CVE-2020-9059 |
LAST UPDATE DATE
2024-08-14T14:18:11.251000+00:00
SOURCES UPDATE DATE
| db: | CERT/CC | id: | VU#142629 | date: | 2022-01-09T00:00:00 |
| db: | VULHUB | id: | VHN-187184 | date: | 2022-09-20T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017816 | date: | 2023-02-10T08:29:00 |
| db: | CNNVD | id: | CNNVD-202201-579 | date: | 2022-09-21T00:00:00 |
| db: | NVD | id: | CVE-2020-9059 | date: | 2022-09-20T17:16:54.653 |
SOURCES RELEASE DATE
| db: | CERT/CC | id: | VU#142629 | date: | 2022-01-07T00:00:00 |
| db: | VULHUB | id: | VHN-187184 | date: | 2022-01-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017816 | date: | 2023-02-10T00:00:00 |
| db: | CNNVD | id: | CNNVD-202201-579 | date: | 2022-01-10T00:00:00 |
| db: | NVD | id: | CVE-2020-9059 | date: | 2022-01-10T14:10:16.303 |