PT-2022-9072 · Silicon+1 · Silicon Labs 500 Series+1

Carlos Kayembe Nkuba + 3 · Published 2022-01-07 · Updated 2022-09-20 · CVE-2020-9059

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Z-Wave devices based on Silicon Labs 500 series chipsets Schlage BE468 version 3.42

Description The issue affects Z-Wave devices that use S0 authentication, leading to uncontrolled resource consumption and resulting in battery exhaustion. For example, the Schlage BE468 door lock is vulnerable and fails open when the battery level is low.

Recommendations For Schlage BE468 version 3.42, consider replacing the batteries more frequently to minimize the risk of the lock failing open due to low battery level. For Z-Wave devices based on Silicon Labs 500 series chipsets, restrict the use of S0 authentication until a patch or fix is available to prevent uncontrolled resource consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2020-9059

Affected Products

Schlage Be468

Silicon Labs 500 Series

References · 7

• https://osv.dev/vulnerability/CVE-2020-9059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9059 · Security Note
• https://github.com/CNK2100/VFuzz-public · Note
• https://kb.cert.org/vuls/id/142629 · Note
• https://ieeexplore.ieee.org/document/9663293 · Note
• https://t.me/cvenotify/36526 · Telegram Post
• https://doi.org/10.1109/ACCESS.2021.3138768 · Note