ID
VAR-202201-0287
CVE
CVE-2020-9061
TITLE
Silicon Labs Z-Wave chipsets contain multiple vulnerabilities
Trust: 0.8
DESCRIPTION
Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages. Various Silicon Labs Z-Wave chipsets do not support encryption, can be downgraded to not use weaker encryption, and are vulnerable to denial of service. Some of these vulnerabilities are inherent in Z-Wave protocol specifications.CVE-2020-10137 Unknown CVE-2020-9057 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data. CVE-2020-9058 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data. CVE-2020-9059 Affected Vendor Statement: This is a known weakness with S0 security. CVE-2020-9060 Affected Vendor Statement: This is a known weakness with S2 security. CVE-2020-9061 Affected Vendor Statement: This is a known weakness with S0 and S2 security.CVE-2020-10137 Unknown CVE-2020-9057 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data. CVE-2020-9058 Affected Vendor Statement: This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data. CVE-2020-9059 Affected Vendor Statement: This is a known weakness with S0 security. CVE-2020-9060 Affected Vendor Statement: This is a known weakness with S2 security. CVE-2020-9061 Affected Vendor Statement: This is a known weakness with S0 and S2 security. plural Z-Wave There is an unspecified vulnerability in the device.Service operation interruption (DoS) It may be in a state
Trust: 2.43
AFFECTED PRODUCTS
| vendor: | silabs | model: | 500 series | scope: | eq | version: | * | Trust: 1.0 |
| vendor: | silabs | model: | uzb-7 | scope: | eq | version: | 7.00 | Trust: 1.0 |
| vendor: | samsung | model: | sth-eth-200 | scope: | eq | version: | 6.04 | Trust: 1.0 |
| vendor: | aeotec | model: | zw090-a | scope: | eq | version: | 3.95 | Trust: 1.0 |
| vendor: | zooz | model: | zst10 | scope: | eq | version: | 6.04 | Trust: 1.0 |
| vendor: | silabs | model: | 700 series | scope: | eq | version: | - | Trust: 1.0 |
| vendor: | silicon | model: | 700 シリーズ | scope: | - | version: | - | Trust: 0.8 |
| vendor: | サムスン | model: | sth-eth-200 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | silicon | model: | uzb-7 | scope: | - | version: | - | Trust: 0.8 |
| vendor: | アイオテック | model: | z-stick gen5 + | scope: | - | version: | - | Trust: 0.8 |
| vendor: | silicon | model: | 500 シリーズ | scope: | - | version: | - | Trust: 0.8 |
| vendor: | zooz | model: | zst10 | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-noinfo | Trust: 1.0 |
| problemtype: | CWE-285 | Trust: 1.0 |
| problemtype: | Lack of information (CWE-noinfo) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote or local
Trust: 0.6
TYPE
authorization issue
Trust: 0.6
PATCH
| title: | Top Page Samsung SAMSUNG | url: | https://www.silabs.com/ | Trust: 0.8 |
| title: | Silicon Labs Z-Wave Chipsets Remediation measures for authorization problem vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=178628 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-9061 | Trust: 4.1 |
| db: | CERT/CC | id: | VU#142629 | Trust: 3.3 |
| db: | JVN | id: | JVNVU94598199 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2021-017764 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202201-604 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-187186 | Trust: 0.1 |
REFERENCES
| url: | https://kb.cert.org/vuls/id/142629 | Trust: 2.5 |
| url: | https://github.com/cnk2100/vfuzz-public | Trust: 2.5 |
| url: | https://ieeexplore.ieee.org/document/9663293 | Trust: 2.5 |
| url: | https://www.kb.cert.org/vuls/id/142629 | Trust: 1.7 |
| url: | https://doi.org/10.1109/access.2021.3138768 | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-9061 | Trust: 1.4 |
| url: | http://jvn.jp/vu/jvnvu94598199/index.html | Trust: 0.8 |
CREDITS
This document was written by Timur Snoke and Art Manion.Statement Date: June 30, 2020
Trust: 0.8
SOURCES
| db: | CERT/CC | id: | VU#142629 |
| db: | VULHUB | id: | VHN-187186 |
| db: | JVNDB | id: | JVNDB-2021-017764 |
| db: | CNNVD | id: | CNNVD-202201-604 |
| db: | NVD | id: | CVE-2020-9061 |
LAST UPDATE DATE
2024-08-14T14:18:11.314000+00:00
SOURCES UPDATE DATE
| db: | CERT/CC | id: | VU#142629 | date: | 2022-01-09T00:00:00 |
| db: | VULHUB | id: | VHN-187186 | date: | 2022-01-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017764 | date: | 2023-02-03T05:36:00 |
| db: | CNNVD | id: | CNNVD-202201-604 | date: | 2022-01-19T00:00:00 |
| db: | NVD | id: | CVE-2020-9061 | date: | 2022-01-18T17:27:05.997 |
SOURCES RELEASE DATE
| db: | CERT/CC | id: | VU#142629 | date: | 2022-01-07T00:00:00 |
| db: | VULHUB | id: | VHN-187186 | date: | 2022-01-10T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-017764 | date: | 2023-02-03T00:00:00 |
| db: | CNNVD | id: | CNNVD-202201-604 | date: | 2022-01-10T00:00:00 |
| db: | NVD | id: | CVE-2020-9061 | date: | 2022-01-10T14:10:16.463 |