Silicon Labs Z-Wave chipsets contain multiple vulnerabilities

Overview

Various Silicon Labs Z-Wave chipsets do not support encryption, can be downgraded to not use weaker encryption, and are vulnerable to denial of service. Some of these vulnerabilities are inherent in Z-Wave protocol specifications.

Description

Z-Wave devices based on Silicon Labs chipsets have multiple vulnerabilities. For further details, including specific devices tested, see Riding the IoT Wave With VFuzz: Discovering Security Flaws in Smart Homes.

CVE-2020-9057
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption.

CVE-2020-9058
Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation do not implement encryption or replay protection.

CVE-2020-9059
Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption which can lead to battery exhaustion.

CVE-2020-9060
Z-Wave devices based on Silicon Labs 500 series chipsets using S2 are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.

CVE-2020-9061
Z-Wave devices based on Silicon Labs 500 and 700 series chipsets are susceptible to denial of service via malformed routing messages.

CVE-2020-10137
Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames.

Impact

Depending on the chipset and device, an attacker within Z-Wave radio range can deny service, cause devices to crash, deplete batteries, intercept, observe, and replay traffic, and control vulnerable devices.

Solution

Mitigations for these vulnerabilities vary based on the chipset and device. In some cases it may be necessary to upgrade to newer hardware, for example, 500 and 700 series chipsets that support S2 authentication and encryption.

Acknowledgements

Thanks to Carlos Kayembe Nkuba, Seulbae Kim, Sven Dietrich, and Heejo Lee for researching and reporting these vulnerabilities.

This document was written by Timur Snoke and Art Manion.

Vendor Information

142629

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Silicon Labs __ Affected

Notified: 2020-06-29 Updated: 2022-01-07

Statement Date: June 30, 2020

CVE-2020-10137	Unknown
CVE-2020-9057	Affected Vendor Statement:
This is a known weakness with unencrypted traffic. S0 and S2 security can encrypt application data.
CVE-2020-9058	Affected Vendor Statement:
This is a known weakness with unencrypted traffic. S0 and S2 can encrypt application data.
CVE-2020-9059	Affected Vendor Statement:
This is a known weakness with S0 security.
CVE-2020-9060	Affected Vendor Statement:
This is a known weakness with S2 security.
CVE-2020-9061	Affected Vendor Statement:
This is a known weakness with S0 and S2 security.

Vendor Statement

Silicon Labs is grateful for the work of CERT.org and the security research community. Any researchers or other parties who discover vulnerabilities in our products are encouraged to notify our Product Security Incident Response Team at https://silabs.com/security/product-security

The vulnerabilities associated with this case represent known weaknesses with various combinations of unencrypted traffic, S0 and S2 security. We have additional guidance documentation in the Case References area. Any product developers who need additional guidance or recommendations are encouraged to contact us at https://silabs.com/support.

References

• [Silicon Labs has additional resources and recommendations at the following links:](<Silicon Labs has additional resources and recommendations at the following links:>)
• <https://www.silabs.com/documents/login/white-papers/INS13474-Z-Wave-Security-Whitepaper.pdf&gt;
• <https://www.silabs.com/documents/login/presentations/PMP13827-2.pdf&gt;

Aeotec Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Dome Home Automation Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Fibaro Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Jasco Unknown

Notified: 2020-06-29 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Linear Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Samsung Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Schlage Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

Zooz Unknown

Notified: 2022-01-07 Updated: 2022-01-07 CVE-2020-10137	Unknown
CVE-2020-9057	Unknown CVE-2020-9058

Vendor Statement

We have not received a statement from the vendor.

References

• <https://ieeexplore.ieee.org/document/9663293&gt;
• <https://doi.org/10.1109/ACCESS.2021.3138768&gt;
• <https://github.com/CNK2100/VFuzz-public&gt;
• <https://products.z-wavealliance.org/products/2559&gt;
• <https://z-wavealliance.org/z-wave-oems-developers/&gt;

Other Information

CVE IDs:	CVE-2020-10137 CVE-2020-9057 CVE-2020-9058 CVE-2020-9059 CVE-2020-9060 CVE-2020-9061
Date Public:	2022-01-07 Date First Published: