PT-2022-9070 · Linear · Linear Wadwaz-1+1

Carlos Kayembe Nkuba + 3 · Published 2022-01-07 · Updated 2022-01-18 · CVE-2020-9057

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets Linear WADWAZ-1 version 3.43 Linear WAPIRZ-1 version 3.43

Description The issue affects Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets, which do not support encryption. This allows an attacker within radio range to take control of or cause a denial of service to a vulnerable device. The attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this issue as it is a problem with the Z-Wave specification for these legacy chipsets.

Recommendations For Linear WADWAZ-1 version 3.43, consider replacing the device with one that uses 500 or 700 series chipsets that support Security 2 (S2) encryption. For Linear WAPIRZ-1 version 3.43, consider replacing the device with one that uses 500 or 700 series chipsets that support Security 2 (S2) encryption. For Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets, consider upgrading to devices that use 500 or 700 series chipsets that support Security 2 (S2) encryption.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-9057

Affected Products

Linear Wadwaz-1

Linear Wapirz-1

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-9057 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9057 · Vendor Advisory
• https://github.com/CNK2100/VFuzz-public · Note
• https://kb.cert.org/vuls/id/142629 · Note
• https://ieeexplore.ieee.org/document/9663293 · Note
• https://t.me/cibsecurity/35153 · Telegram Post
• https://doi.org/10.1109/ACCESS.2021.3138768 · Note