ID
VAR-202201-0277
CVE
CVE-2020-9057
TITLE
Silicon Labs Z-Wave chipsets contain multiple vulnerabilities
Trust: 0.8
DESCRIPTION
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable. Some of these vulnerabilities are inherent in Z-Wave protocol specifications.CVE-2020-10137 Unknown CVE-2020-9057 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data. CVE-2020-9058 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data. CVE-2020-9059 Affected Vendor Statement: This is a known weakness with S0 security. CVE-2020-9060 Affected Vendor Statement: This is a known weakness with S2 security. CVE-2020-9061 Affected Vendor Statement: This is a known weakness with S0 and S2 security.CVE-2020-10137 Unknown CVE-2020-9057 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data. CVE-2020-9058 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data. CVE-2020-9059 Affected Vendor Statement: This is a known weakness with S0 security. CVE-2020-9060 Affected Vendor Statement: This is a known weakness with S2 security. CVE-2020-9061 Affected Vendor Statement: This is a known weakness with S0 and S2 security. plural Z-Wave The device has a vulnerability related to lack of encryption of sensitive data.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
Trust: 2.43
AFFECTED PRODUCTS
| vendor: | silabs | model: | 300 series | scope: | eq | version: | * | Trust: 1.0 |
| vendor: | silabs | model: | 200 series | scope: | eq | version: | * | Trust: 1.0 |
| vendor: | linear | model: | wapirz-1 | scope: | eq | version: | 3.43 | Trust: 1.0 |
| vendor: | silabs | model: | 100 series | scope: | eq | version: | * | Trust: 1.0 |
| vendor: | linear | model: | wadwaz-1 | scope: | eq | version: | 3.43 | Trust: 1.0 |
| vendor: | silicon | model: | 200 シリーズ | scope: | - | version: | - | Trust: 0.8 |
| vendor: | linear | model: | wadwaz-1 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | silicon | model: | 300 シリーズ | scope: | - | version: | - | Trust: 0.8 |
| vendor: | silicon | model: | 100 シリーズ | scope: | - | version: | - | Trust: 0.8 |
| vendor: | linear | model: | wapirz-1 | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-311 | Trust: 1.1 |
| problemtype: | Lack of encryption of critical data (CWE-311) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote or local
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | Top Page Silicon Labs, Inc.Silicon Labs, Inc. | url: | https://na.niceforyou.com/ | Trust: 0.8 |
| title: | VFuzz-public | url: | https://github.com/CNK2100/VFuzz-public | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-9057 | Trust: 4.2 |
| db: | CERT/CC | id: | VU#142629 | Trust: 3.3 |
| db: | JVN | id: | JVNVU94598199 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2021-017779 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202201-586 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-187182 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2020-9057 | Trust: 0.1 |
REFERENCES
| url: | https://github.com/cnk2100/vfuzz-public | Trust: 2.6 |
| url: | https://kb.cert.org/vuls/id/142629 | Trust: 2.5 |
| url: | https://ieeexplore.ieee.org/document/9663293 | Trust: 2.5 |
| url: | https://www.kb.cert.org/vuls/id/142629 | Trust: 1.7 |
| url: | https://doi.org/10.1109/access.2021.3138768 | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-9057 | Trust: 1.4 |
| url: | http://jvn.jp/vu/jvnvu94598199/index.html | Trust: 0.8 |
CREDITS
This document was written by Timur Snoke and Art Manion.Statement Date: June 30, 2020
Trust: 0.8
SOURCES
| db: | CERT/CC | id: | VU#142629 |
| db: | VULHUB | id: | VHN-187182 |
| db: | VULMON | id: | CVE-2020-9057 |
| db: | JVNDB | id: | JVNDB-2021-017779 |
| db: | CNNVD | id: | CNNVD-202201-586 |
| db: | NVD | id: | CVE-2020-9057 |
LAST UPDATE DATE
2024-08-14T14:18:11.153000+00:00
SOURCES UPDATE DATE
| db: | CERT/CC | id: | VU#142629 | date: | 2022-01-09T00:00:00 |
| db: | VULHUB | id: | VHN-187182 | date: | 2022-01-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017779 | date: | 2023-02-08T01:58:00 |
| db: | CNNVD | id: | CNNVD-202201-586 | date: | 2022-01-19T00:00:00 |
| db: | NVD | id: | CVE-2020-9057 | date: | 2022-01-18T17:10:27.780 |
SOURCES RELEASE DATE
| db: | CERT/CC | id: | VU#142629 | date: | 2022-01-07T00:00:00 |
| db: | VULHUB | id: | VHN-187182 | date: | 2022-01-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017779 | date: | 2023-02-08T00:00:00 |
| db: | CNNVD | id: | CNNVD-202201-586 | date: | 2022-01-10T00:00:00 |
| db: | NVD | id: | CVE-2020-9057 | date: | 2022-01-10T14:10:16.150 |