« Volver al listado

CVE-2018-19983

Estado: ModificadaMedia (6.5)—

An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending divided "Nonce Get (0x98 0x81)" frames. The reason for dividing the "Nonce Get" frame is that, in security version S0, when a node receives a "Nonce Get" frame, the node produces a random new nonce and sends it to the Src node of the received "Nonce Get" frame.

Leer descripción completaMostrar menos

After the nonce value is generated and transmitted, the node transitions to wait mode. At this time, when "Nonce Get" is received again, the node discards the previous nonce value and generates a random nonce again. Therefore, because the frame is encrypted with previous nonce value, the received normal frame cannot be decrypted.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Silabs — Z-wave S0 FirmwareSilabs — Z-wave S2 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-19983",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.1,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-09T19:29:00.530",
  "references": [
    {
      "url": "https://github.com/min1233/CVE/blob/master/2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/min1233/CVE/blob/master/2",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-330"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending divided \"Nonce Get (0x98 0x81)\" frames. The reason for dividing the \"Nonce Get\" frame is that, in security version S0, when a node receives a \"Nonce Get\" frame, the node produces a random new nonce and sends it to the Src node of the received \"Nonce Get\" frame. After the nonce value is generated and transmitted, the node transitions to wait mode. At this time, when \"Nonce Get\" is received again, the node discards the previous nonce value and generates a random nonce again. Therefore, because the frame is encrypted with previous nonce value, the received normal frame cannot be decrypted."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en dispositivos Sigma Design Z-Wave, del S0 al S2. En primer lugar, un atacante prepara un programa de transmisión de frames Z-Wave (Z-Wave PC Controller, OpenZWave, CC1110, etc.). A continuación, el atacante lleva a cabo un ataque de denegación de servicio (DoS) contra el producto Z-Wave S0 Security mediante el envío continuado de frames \"Nonce Get (0x98 0x81)\" divididos. El motivo para dividir el frame \"Nonce Get\" es que, en la versión S0 de seguridad, cuando un nodo recibe el frame \"Nonce Get\", éste produce un nuevo nonce aleatorio y lo envía al nodo Src del frame \"Nonce Get\" recibido. Una vez se ha generado y transmitido el valor del nonce, el nodo pasa a modo de espera. En este momento, cuando se vuelve a recibir \"Nonce Get\", el nodo descarta el nonce anterior y genera un nonce aleatorio de nuevo. Por lo tanto, debido a que el frame está cifrado con el valor del nonce anterior, el frame normal recibido no puede ser descifrado."
    }
  ],
  "lastModified": "2026-06-17T01:50:14.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:z-wave_s0_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22DA6D02-7743-4D79-96D7-5DBDF97D4ED6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:z-wave_s0:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6FD6AAFA-091C-4CF1-B272-9B77DC77605E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:z-wave_s2_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FE4A9F9-E3AB-40BB-B11D-59A58DD038D3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:z-wave_s2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "845F081A-2499-4CB9-956D-7162AD3CD326"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}