search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Silicon Labs Z-Wave chipsets contain multiple vulnerabilities

Vulnerability Note VU#142629

Original Release Date: 2022-01-07 | Last Revised: 2022-01-09

Overview

Various Silicon Labs Z-Wave chipsets do not support encryption, can be downgraded to not use weaker encryption, and are vulnerable to denial of service. Some of these vulnerabilities are inherent in Z-Wave protocol specifications.

Description

Z-Wave devices based on Silicon Labs chipsets have multiple vulnerabilities. For further details, including specific devices tested, see Riding the IoT Wave With VFuzz: Discovering Security Flaws in Smart Homes.

CVE-2020-9057
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption.

CVE-2020-9058
Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation do not implement encryption or replay protection.

CVE-2020-9059
Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption which can lead to battery exhaustion.

CVE-2020-9060
Z-Wave devices based on Silicon Labs 500 series chipsets using S2 are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.

CVE-2020-9061
Z-Wave devices based on Silicon Labs 500 and 700 series chipsets are susceptible to denial of service via malformed routing messages.

CVE-2020-10137
Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames.

Impact

Depending on the chipset and device, an attacker within Z-Wave radio range can deny service, cause devices to crash, deplete batteries, intercept, observe, and replay traffic, and control vulnerable devices.

Solution

Mitigations for these vulnerabilities vary based on the chipset and device. In some cases it may be necessary to upgrade to newer hardware, for example, 500 and 700 series chipsets that support S2 authentication and encryption.

Acknowledgements

Thanks to Carlos Kayembe Nkuba, Seulbae Kim, Sven Dietrich, and Heejo Lee for researching and reporting these vulnerabilities.

This document was written by Timur Snoke and Art Manion.

Vendor Information

142629
 

Silicon Labs Affected

Notified:  2020-06-29 Updated: 2022-01-07

Statement Date:   June 30, 2020

CVE-2020-10137 Unknown
CVE-2020-9057 Affected
Vendor Statement:
This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data.
CVE-2020-9058 Affected
Vendor Statement:
This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data.
CVE-2020-9059 Affected
Vendor Statement:
This is a known weakness with S0 security.
CVE-2020-9060 Affected
Vendor Statement:
This is a known weakness with S2 security.
CVE-2020-9061 Affected
Vendor Statement:
This is a known weakness with S0 and S2 security.

Vendor Statement

Silicon Labs is grateful for the work of CERT.org and the security research community. Any researchers or other parties who discover vulnerabilities in our products are encouraged to notify our Product Security Incident Response Team at https://silabs.com/security/product-security

The vulnerabilities associated with this case represent known weaknesses with various combinations of unencrypted traffic, S0 and S2 security. We have additional guidance documentation in the Case References area. Any product developers who need additional guidance or recommendations are encouraged to contact us at https://silabs.com/support.

References

CERT Addendum

There are no additional comments at this time.

Aeotec Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.

Dome Home Automation Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.

Fibaro Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.

Jasco Unknown

Notified:  2020-06-29 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

CERT Addendum

There are no additional comments at this time.

Linear Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.

Samsung Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.

Schlage Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.

Zooz Unknown

Notified:  2022-01-07 Updated: 2022-01-07

CVE-2020-10137 Unknown
CVE-2020-9057 Unknown
CVE-2020-9058 Unknown
CVE-2020-9059 Unknown
CVE-2020-9060 Unknown
CVE-2020-9061 Unknown

Vendor Statement

We have not received a statement from the vendor.


Other Information

CVE IDs: CVE-2020-10137 CVE-2020-9057 CVE-2020-9058 CVE-2020-9059 CVE-2020-9060 CVE-2020-9061
Date Public: 2022-01-07
Date First Published: 2022-01-07
Date Last Updated: 2022-01-09 04:10 UTC
Document Revision: 5

Sponsored by CISA.