PT-2022-8315 · Silicon · Silicon Labs 700 Series

Carlos Kayembe Nkuba + 3 · Published 2022-01-09 · Updated 2022-01-18 · CVE-2020-10137

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Z-Wave devices based on Silicon Labs 700 series chipsets (affected versions not specified)

Description The issue affects Z-Wave devices that use S2 authentication and are based on Silicon Labs 700 series chipsets. These devices do not properly authenticate or encrypt FIND NODE IN RANGE frames. As a result, a remote, unauthenticated attacker can inject a FIND NODE IN RANGE frame with an invalid random payload. This action can deny service by blocking the processing of upcoming events.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-10137

Affected Products

Silicon Labs 700 Series

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-10137 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10137 · Vendor Advisory
• https://github.com/CNK2100/VFuzz-public · Note
• https://kb.cert.org/vuls/id/142629 · Note
• https://ieeexplore.ieee.org/document/9663293 · Note
• https://doi.org/10.1109/ACCESS.2021.3138768 · Note