PT-2024-34459 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: Insecure permissions in the software allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service DoS...

PT-2024-34461 · Silicon · Z-Wave Series 500

Name of the Vulnerable Software and Affected Versions: Silicon Labs Z-Wave Series 500 version 6.84.0 Description: An issue in Silicon Labs Z-Wave Series 500 allows attackers to execute arbitrary code. Recommendations: For version 6.84.0, update to a newer version that contains a fix for this issu...

CVE-2024-50920

Insecure permissions in Silicon Labs SiLabs Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets...

CVE-2024-50930

An issue in Silicon Labs Z-Wave Series 500 version v6.84.0 allows an attacker to execute arbitrary code . The documents do not provide specific technical details regarding the root cause or the specific component involved. To mitigate this risk, it is recommended to update to a newer version that...

CVE-2024-50924

Insecure permissions in Silicon Labs SiLabs Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller...

CVE-2024-50929

Insecure permissions in Silicon Labs SiLabs Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service DoS...

PT-2024-34456 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the Silicon Labs SiLabs Z-Wave Series 700 and 800, which allows attackers to cause a Denial of Service DoS by repeatedly...

CVE-2024-50921

Insecure permissions in Silicon Labs SiLabs Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service DoS via repeatedly sending crafted packets to the controller...

Malicious code in unlock-wave (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11479 Malicious code in unlock-wave (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-51557

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted...

CVE-2024-51558

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain...

CVE-2024-51559

This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts...

CVE-2024-51560

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message...

CVE-2024-51557

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted...

CVE-2024-51560

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message...

CVE-2024-51559

This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts...

CVE-2024-51558

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain...

CVE-2024-51556

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CVE-2024-51556

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...