CVE-2020-9060

State: Published
Severity: Not scored
Published: Jan 7, 2022
Updated: Sep 16, 2024
Reserved: Feb 18, 2020

Description

Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.

Scores

The record has no CVSS score.

Weaknesses

CWE-346 Origin Validation Error
CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
ZEN25ZooZ	5.03Affected
ZEN20ZooZ	5.03Affected
ZST10ZooZ	6.04Affected
FGWPB-111Fibaro	4.3Affected
500 seriesSilicon Labs	allAffected
ZW090-AAeon Labs	3.95Affected

References

https://kb.cert.org/vuls/id/142629third-party-advisory
https://ieeexplore.ieee.org/document/9663293
https://github.com/CNK2100/VFuzz-public
https://doi.org/10.1109/ACCESS.2021.3138768
VU#142629third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.