CVE-2020-9060 : What You Need to Know

Z-Wave devices using Silicon Labs 500 series chipsets are vulnerable to denial of service attacks due to malformed messages.

Understanding CVE-2020-9060

This CVE affects various Z-Wave devices based on Silicon Labs 500 series chipsets, potentially leading to denial of service and resource exhaustion.

What is CVE-2020-9060?

Z-Wave devices utilizing Silicon Labs 500 series chipsets, including products from vendors like ZooZ, Fibaro, Silicon Labs, and Aeon Labs, are susceptible to denial of service attacks through specific message types.

The Impact of CVE-2020-9060

The vulnerability can result in denial of service and resource exhaustion on affected Z-Wave devices, potentially disrupting their normal operation.

Technical Details of CVE-2020-9060

This section provides detailed technical insights into the CVE-2020-9060 vulnerability.

Vulnerability Description

The vulnerability arises from the handling of specific message types, such as SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST, leading to denial of service and resource exhaustion.

Affected Systems and Versions

ZooZ ZST10 version 6.04
ZooZ ZEN20 version 5.03
ZooZ ZEN25 version 5.03
Aeon Labs ZW090-A version 3.95
Fibaro FGWPB-111 version 4.3
Silicon Labs 500 series (all versions)

Exploitation Mechanism

Attackers can exploit this vulnerability by sending malformed messages of specific types to the affected Z-Wave devices, causing denial of service and resource depletion.

Mitigation and Prevention

Protecting systems from CVE-2020-9060 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply vendor-supplied patches promptly.
Monitor network traffic for any suspicious activity.
Implement network segmentation to isolate vulnerable devices.

Long-Term Security Practices

Regularly update firmware and software on Z-Wave devices.
Conduct security assessments and penetration testing on IoT devices.

Patching and Updates

Stay informed about security advisories from vendors.
Apply patches and updates as soon as they are available to mitigate the vulnerability.