PT-2022-7730 · Z-Wave · Z-Wave

Published 2022-02-04 · Updated 2022-02-09 · CVE-2013-20003

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security)

Description The issue affects Z-Wave devices, allowing an attacker within radio range to spoof traffic due to the use of a known, shared network key of all zeros. This enables potential manipulation of the devices.

Recommendations For Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security), consider changing the network key to a unique, non-zero value to prevent spoofing. As a temporary workaround, restrict access to the devices to minimize the risk of exploitation.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-338

Related Identifiers

CVE-2013-20003

Affected Products

Z-Wave

References · 5

• 🔥 https://pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-20003 · Security Note
• https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdf · Note
• https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security · Note
• https://t.me/cibsecurity/36895 · Telegram Post