Vulnerability-Lookup

CVE-2020-9060 (GCVE-0-2020-9060)

Vulnerability from cvelistv5 – Published: 2022-01-07 04:30 – Updated: 2024-09-16 16:33

Summary

Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.

Severity ?

No CVSS data available.

CWE

CWE-346 - Origin Validation Error
CWE-400 - Uncontrolled Resource Consumption

Assigner

certcc

References

URL

Tags

	https://kb.cert.org/vuls/id/142629	third-party-advisoryx_refsource_CERT-VN
	https://ieeexplore.ieee.org/document/9663293	x_refsource_MISC
	https://github.com/CNK2100/VFuzz-public	x_refsource_MISC
	https://doi.org/10.1109/ACCESS.2021.3138768	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/142629	third-party-advisoryx_refsource_CERT-VN

Impacted products

Vendor

Product

Version

ZooZ

ZEN25

Affected: 5.03

ZooZ	ZEN20	Affected: 5.03
ZooZ	ZST10	Affected: 6.04
Fibaro	FGWPB-111	Affected: 4.3
Silicon Labs	500 series	Affected: all
Aeon Labs	ZW090-A	Affected: 3.95

Credits

Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:19:19.795Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/142629"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ieeexplore.ieee.org/document/9663293"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CNK2100/VFuzz-public"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
          },
          {
            "name": "VU#142629",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/142629"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ZEN25",
          "vendor": "ZooZ",
          "versions": [
            {
              "status": "affected",
              "version": "5.03"
            }
          ]
        },
        {
          "product": "ZEN20",
          "vendor": "ZooZ",
          "versions": [
            {
              "status": "affected",
              "version": "5.03"
            }
          ]
        },
        {
          "product": "ZST10",
          "vendor": "ZooZ",
          "versions": [
            {
              "status": "affected",
              "version": "6.04"
            }
          ]
        },
        {
          "product": "FGWPB-111",
          "vendor": "Fibaro",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            }
          ]
        },
        {
          "product": "500 series",
          "vendor": "Silicon Labs",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "product": "ZW090-A",
          "vendor": "Aeon Labs",
          "versions": [
            {
              "status": "affected",
              "version": "3.95"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee"
        }
      ],
      "datePublic": "2021-12-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-07T23:06:11.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://kb.cert.org/vuls/id/142629"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ieeexplore.ieee.org/document/9663293"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CNK2100/VFuzz-public"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
        },
        {
          "name": "VU#142629",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/142629"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "DATE_PUBLIC": "2021-12-27T05:00:00.000Z",
          "ID": "CVE-2020-9060",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ZEN25",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.03"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ZEN20",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.03"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ZST10",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "6.04"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ZooZ"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "FGWPB-111",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "4.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Fibaro"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "500 series",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "all"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Silicon Labs"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ZW090-A",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "3.95"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Aeon Labs"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346 Origin Validation Error"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400 Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.cert.org/vuls/id/142629",
              "refsource": "CERT-VN",
              "url": "https://kb.cert.org/vuls/id/142629"
            },
            {
              "name": "https://ieeexplore.ieee.org/document/9663293",
              "refsource": "MISC",
              "url": "https://ieeexplore.ieee.org/document/9663293"
            },
            {
              "name": "https://github.com/CNK2100/VFuzz-public",
              "refsource": "MISC",
              "url": "https://github.com/CNK2100/VFuzz-public"
            },
            {
              "name": "https://doi.org/10.1109/ACCESS.2021.3138768",
              "refsource": "MISC",
              "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
            },
            {
              "name": "VU#142629",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/142629"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2020-9060",
    "datePublished": "2022-01-07T04:30:28.026Z",
    "dateReserved": "2020-02-18T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:33:05.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GSD-2020-9060

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-9060

Aliases

CVE-2020-9060

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-9060",
    "description": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.",
    "id": "GSD-2020-9060"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-9060"
      ],
      "details": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.",
      "id": "GSD-2020-9060",
      "modified": "2023-12-13T01:21:53.078773Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cert@cert.org",
        "DATE_PUBLIC": "2021-12-27T05:00:00.000Z",
        "ID": "CVE-2020-9060",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ZEN25",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "5.03"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ZEN20",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "5.03"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "ZST10",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "6.04"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ZooZ"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "FGWPB-111",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "4.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Fibaro"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "500 series",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "all"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Silicon Labs"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "ZW090-A",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "3.95"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Aeon Labs"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-346 Origin Validation Error"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-400 Uncontrolled Resource Consumption"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://kb.cert.org/vuls/id/142629",
            "refsource": "CERT-VN",
            "url": "https://kb.cert.org/vuls/id/142629"
          },
          {
            "name": "https://ieeexplore.ieee.org/document/9663293",
            "refsource": "MISC",
            "url": "https://ieeexplore.ieee.org/document/9663293"
          },
          {
            "name": "https://github.com/CNK2100/VFuzz-public",
            "refsource": "MISC",
            "url": "https://github.com/CNK2100/VFuzz-public"
          },
          {
            "name": "https://doi.org/10.1109/ACCESS.2021.3138768",
            "refsource": "MISC",
            "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
          },
          {
            "name": "VU#142629",
            "refsource": "CERT-VN",
            "url": "https://www.kb.cert.org/vuls/id/142629"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:silabs:500_series_firmware:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:aeotec:zw090-a:3.95:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:zooz:zst10:6.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:zooz:zen20:5.03:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:zooz:zen25:5.03:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fibaro:fgwpb-111:4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2020-9060"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/CNK2100/VFuzz-public",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/CNK2100/VFuzz-public"
            },
            {
              "name": "https://kb.cert.org/vuls/id/142629",
              "refsource": "CERT-VN",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://kb.cert.org/vuls/id/142629"
            },
            {
              "name": "https://ieeexplore.ieee.org/document/9663293",
              "refsource": "MISC",
              "tags": [
                "Broken Link"
              ],
              "url": "https://ieeexplore.ieee.org/document/9663293"
            },
            {
              "name": "https://doi.org/10.1109/ACCESS.2021.3138768",
              "refsource": "MISC",
              "tags": [
                "Broken Link"
              ],
              "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
            },
            {
              "name": "VU#142629",
              "refsource": "CERT-VN",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://www.kb.cert.org/vuls/id/142629"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.1,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 6.5,
          "impactScore": 6.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-09-20T17:16Z",
      "publishedDate": "2022-01-10T14:10Z"
    }
  }
}

GHSA-RCJH-H6HV-XWCC

Vulnerability from github – Published: 2022-01-11 00:01 – Updated: 2022-09-21 00:00

Details

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-9060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-10T14:10:00Z",
    "severity": "MODERATE"
  },
  "details": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.",
  "id": "GHSA-rcjh-h6hv-xwcc",
  "modified": "2022-09-21T00:00:40Z",
  "published": "2022-01-11T00:01:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9060"
    },
    {
      "type": "WEB",
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CNK2100/VFuzz-public"
    },
    {
      "type": "WEB",
      "url": "https://ieeexplore.ieee.org/document/9663293"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/142629"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/142629"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

FKIE_CVE-2020-9060

Vulnerability from fkie_nvd - Published: 2022-01-10 14:10 - Updated: 2024-11-21 05:39

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
cret@cert.org	https://doi.org/10.1109/ACCESS.2021.3138768	Broken Link
cret@cert.org	https://github.com/CNK2100/VFuzz-public	Third Party Advisory
cret@cert.org	https://ieeexplore.ieee.org/document/9663293	Broken Link
cret@cert.org	https://kb.cert.org/vuls/id/142629	Third Party Advisory, US Government Resource
cret@cert.org	https://www.kb.cert.org/vuls/id/142629	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://doi.org/10.1109/ACCESS.2021.3138768	Broken Link
af854a3a-2127-422b-91ae-364da2661108	https://github.com/CNK2100/VFuzz-public	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://ieeexplore.ieee.org/document/9663293	Broken Link
af854a3a-2127-422b-91ae-364da2661108	https://kb.cert.org/vuls/id/142629	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.kb.cert.org/vuls/id/142629	Third Party Advisory, US Government Resource

Impacted products

Vendor	Product	Version
silabs	500_series_firmware	*
aeotec	zw090-a	3.95
fibaro	fgwpb-111	4.3
zooz	zen20	5.03
zooz	zen25	5.03
zooz	zst10	6.04

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:500_series_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "92760285-A1DD-4569-AD71-834BBF2D9E64",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:aeotec:zw090-a:3.95:*:*:*:*:*:*:*",
              "matchCriteriaId": "5B58B8CF-11BD-402E-8625-4C78629F181E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fibaro:fgwpb-111:4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4D1E765-5656-46A2-BA3E-02A6AD1C0D53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zooz:zen20:5.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "41C64AB8-9EBB-4C66-9210-643687820B44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zooz:zen25:5.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BA9AB45-0DE1-40CD-961C-4ADB8B506B45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:zooz:zst10:6.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "7DB7F120-CB63-46F6-AC91-8C64BC5D57BC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Z-Wave basados en los conjuntos de chips de la serie 500 de Silicon Labs que usan S2, incluidos, entre otros, ZooZ ZST10 versi\u00f3n 6.04, ZooZ ZEN20 versi\u00f3n 5.03, ZooZ ZEN25 versi\u00f3n 5.03, Aeon Labs ZW090-A versi\u00f3n 3. 95, y Fibaro FGWPB-111 versi\u00f3n 4.3, son susceptibles a una denegaci\u00f3n de servicio y al agotamiento de recursos por medio de mensajes malformados SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, o NIF REQUEST"
    }
  ],
  "id": "CVE-2020-9060",
  "lastModified": "2024-11-21T05:39:56.113",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 6.5,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-10T14:10:16.380",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/CNK2100/VFuzz-public"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://ieeexplore.ieee.org/document/9663293"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://kb.cert.org/vuls/id/142629"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/142629"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/CNK2100/VFuzz-public"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://ieeexplore.ieee.org/document/9663293"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://kb.cert.org/vuls/id/142629"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/142629"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "cret@cert.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2020-9060 (GCVE-0-2020-9060)

GSD-2020-9060

GHSA-RCJH-H6HV-XWCC

FKIE_CVE-2020-9060

Tags

Sightings

Nomenclature