CVEvulnerability
CVE-2020-9060
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-01-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 6.1 MEDIUM — AV:A/AC:L/Au:N/C:N/I:N/A:C
- Weaknesses
- CWE-346, CWE-400
Description
Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.
Affected configurations
• silabs 500 series firmware
• aeotec zw090-a 3.95
• fibaro fgwpb-111 4.3
• zooz zen20 5.03
• zooz zen25 5.03
• zooz zst10 6.04
Related
References
- https://doi.org/10.1109/ACCESS.2021.3138768 Broken Link
- https://github.com/CNK2100/VFuzz-public Third Party Advisory
- https://ieeexplore.ieee.org/document/9663293 Broken Link
- https://kb.cert.org/vuls/id/142629 Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/142629 Third Party Advisory, US Government Resource
- https://doi.org/10.1109/ACCESS.2021.3138768 Broken Link
- https://github.com/CNK2100/VFuzz-public Third Party Advisory
- https://ieeexplore.ieee.org/document/9663293 Broken Link
- https://kb.cert.org/vuls/id/142629 Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/142629 Third Party Advisory, US Government Resource