VDB
CVE-2020-9060
CVE-2020-9060
PUBLISHED
CVSS 6.5 MEDIUM
Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.
EPSS 0.53% · 42.1th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.53%
42.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| zooz | zen20 | 5.03 |
| ZooZ | ZEN20 | 5.03 |
| Fibaro | FGWPB-111 | 4.3 |
| aeotec | zw090-a | 3.95 |
| Aeon Labs | ZW090-A | 3.95 |
| silabs | 500_series_firmware | |
| fibaro | fgwpb-111 | 4.3 |
| ZooZ | ZST10 | 6.04 |
| Silicon Labs | 500 series | all |
| zooz | zen25 | 5.03 |
| ZooZ | ZEN25 | 5.03 |
| zooz | zst10 | 6.04 |
Timeline
- Jan 7, 2022 CVE Published
- Jan 7, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 2, 2022 EPSS Score
- Apr 24, 2022 EPSS Score
- Jun 17, 2022 EPSS Score
- Aug 10, 2022 EPSS Score
- Oct 3, 2022 EPSS Score
- Nov 26, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 13, 2023 EPSS Score
- May 5, 2023 EPSS Score
References
- https://kb.cert.org/vuls/id/142629 third-party-advisory
- https://ieeexplore.ieee.org/document/9663293 url
- https://github.com/CNK2100/VFuzz-public url
- https://doi.org/10.1109/ACCESS.2021.3138768 url
- VU#142629 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-9060 advisory