PT-2022-9074 · Aeon+3 · Aeon Labs Zw090-A+5

Carlos Kayembe Nkuba + 3 · Published 2022-01-07 · Updated 2022-01-18 · CVE-2020-9061

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Z-Wave devices using Silicon Labs 500 and 700 series chipsets versions (affected versions not specified) SiLabs UZB-7 version 7.00 ZooZ ZST10 version 6.04 Aeon Labs ZW090-A version 3.95 Samsung STH-ETH-200 version 6.04

Description The issue affects Z-Wave devices using Silicon Labs 500 and 700 series chipsets, making them susceptible to denial of service via malformed routing messages.

Recommendations For SiLabs UZB-7 version 7.00, consider disabling the routing message handling functionality until a patch is available. For ZooZ ZST10 version 6.04, restrict access to the device to minimize the risk of exploitation. For Aeon Labs ZW090-A version 3.95, avoid processing malformed routing messages until the issue is resolved. For Samsung STH-ETH-200 version 6.04, limit the device's exposure to potentially malicious routing messages. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2020-9061

Affected Products

Aeon Labs Zw090-A

Samsung Sth-Eth-200

Silabs Uzb-7

Silicon Labs 500 Series

Silicon Labs 700 Series

Zooz Zst10

References · 6

• https://osv.dev/vulnerability/CVE-2020-9061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9061 · Security Note
• https://github.com/CNK2100/VFuzz-public · Note
• https://ieeexplore.ieee.org/document/9663293 · Note
• https://kb.cert.org/vuls/id/142629 · Note
• https://doi.org/10.1109/ACCESS.2021.3138768 · Note