PT-2022-9071 · Dome+3 · Dome Dm501+3

Carlos Kayembe Nkuba + 3 · Published 2022-01-07 · Updated 2022-01-18 · CVE-2020-9058

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Z-Wave devices based on Silicon Labs 500 series chipsets versions (affected versions not specified) Linear LB60Z-1 version 3.5 Dome DM501 version 4.26 Jasco ZW4201 version 4.05

Description The issue concerns Z-Wave devices that do not implement encryption or replay protection, specifically those based on Silicon Labs 500 series chipsets using CRC-16 encapsulation.

Recommendations For Linear LB60Z-1 version 3.5, consider implementing additional security measures to protect against replay attacks. For Dome DM501 version 4.26, restrict access to sensitive functions until encryption can be implemented. For Jasco ZW4201 version 4.05, avoid using the device for sensitive applications until replay protection is added. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-9058

Affected Products

Dome Dm501

Jasco Zw4201

Linear Lb60Z-1

Silicon Labs 500 Series

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-9058 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9058 · Vendor Advisory
• https://github.com/CNK2100/VFuzz-public · Note
• https://kb.cert.org/vuls/id/142629 · Note
• https://ieeexplore.ieee.org/document/9663293 · Note
• https://doi.org/10.1109/ACCESS.2021.3138768 · Note