« Volver al listado

CVE-2020-9058

Estado: ModificadaAlta (8.1)—

Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Dome — Dm501Jasco — Zw4201Linear — Lb60z-1Silabs — 500 Series Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9058",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.8,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Linear",
          "product": "LB60Z-1",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            }
          ]
        },
        {
          "vendor": "Dome",
          "product": "DM501",
          "versions": [
            {
              "status": "affected",
              "version": "4.26"
            }
          ]
        },
        {
          "vendor": "Jasco",
          "product": "ZW4201",
          "versions": [
            {
              "status": "affected",
              "version": "4.05"
            }
          ]
        },
        {
          "vendor": "Silicon Labs",
          "product": "500 series",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-10T14:10:16.227",
  "references": [
    {
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/CNK2100/VFuzz-public",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://ieeexplore.ieee.org/document/9663293",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/CNK2100/VFuzz-public",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ieeexplore.ieee.org/document/9663293",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cret@cert.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-311"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Z-Wave basados en los conjuntos de chips de la serie 500 de Silicon Labs que usan encapsulación CRC-16, incluidos, entre otros, el Linear LB60Z-1 versión 3.5, el Dome DM501 versión 4.26 y el Jasco ZW4201 versión 4.05, no implementan el cifrado ni la protección contra repeticiones"
    }
  ],
  "lastModified": "2026-06-17T03:27:25.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:500_series_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92760285-A1DD-4569-AD71-834BBF2D9E64"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:dome:dm501:4.26:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB98AB76-E79B-4B2C-B660-BB76CAF1F270"
            },
            {
              "criteria": "cpe:2.3:o:jasco:zw4201:4.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9733CB5-0006-46B8-83F4-26539032BDAD"
            },
            {
              "criteria": "cpe:2.3:o:linear:lb60z-1:3.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F3546F0-395D-4B57-B15D-E55062B72A22"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}