« Volver al listado

CVE-2020-9060

Estado: ModificadaMedia (6.5)—

Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Aeotec — Zw090-aFibaro — Fgwpb-111Silabs — 500 Series FirmwareZooz — Zen20Zooz — Zen25Zooz — Zst10

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9060",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.1,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "ZooZ",
          "product": "ZEN25",
          "versions": [
            {
              "status": "affected",
              "version": "5.03"
            }
          ]
        },
        {
          "vendor": "ZooZ",
          "product": "ZEN20",
          "versions": [
            {
              "status": "affected",
              "version": "5.03"
            }
          ]
        },
        {
          "vendor": "ZooZ",
          "product": "ZST10",
          "versions": [
            {
              "status": "affected",
              "version": "6.04"
            }
          ]
        },
        {
          "vendor": "Fibaro",
          "product": "FGWPB-111",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            }
          ]
        },
        {
          "vendor": "Silicon Labs",
          "product": "500 series",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "vendor": "Aeon Labs",
          "product": "ZW090-A",
          "versions": [
            {
              "status": "affected",
              "version": "3.95"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-01-10T14:10:16.380",
  "references": [
    {
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/CNK2100/VFuzz-public",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://ieeexplore.ieee.org/document/9663293",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/CNK2100/VFuzz-public",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ieeexplore.ieee.org/document/9663293",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/142629",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cret@cert.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Z-Wave basados en los conjuntos de chips de la serie 500 de Silicon Labs que usan S2, incluidos, entre otros, ZooZ ZST10 versión 6.04, ZooZ ZEN20 versión 5.03, ZooZ ZEN25 versión 5.03, Aeon Labs ZW090-A versión 3. 95, y Fibaro FGWPB-111 versión 4.3, son susceptibles a una denegación de servicio y al agotamiento de recursos por medio de mensajes malformados SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, o NIF REQUEST"
    }
  ],
  "lastModified": "2026-06-17T03:27:25.630",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:500_series_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92760285-A1DD-4569-AD71-834BBF2D9E64"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:aeotec:zw090-a:3.95:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B58B8CF-11BD-402E-8625-4C78629F181E"
            },
            {
              "criteria": "cpe:2.3:o:fibaro:fgwpb-111:4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4D1E765-5656-46A2-BA3E-02A6AD1C0D53"
            },
            {
              "criteria": "cpe:2.3:o:zooz:zen20:5.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41C64AB8-9EBB-4C66-9210-643687820B44"
            },
            {
              "criteria": "cpe:2.3:o:zooz:zen25:5.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BA9AB45-0DE1-40CD-961C-4ADB8B506B45"
            },
            {
              "criteria": "cpe:2.3:o:zooz:zst10:6.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DB7F120-CB63-46F6-AC91-8C64BC5D57BC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}