CVE-2020-9057 : Vulnerability Insights and Analysis

Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets have a vulnerability that allows attackers within radio range to take control or cause denial of service. This CVE affects Linear's WADWAZ-1 and WAPIRZ-1 versions 3.43.

Understanding CVE-2020-9057

This CVE impacts Z-Wave devices using specific chipsets, enabling unauthorized control and potential denial of service attacks.

What is CVE-2020-9057?

Z-Wave devices with certain Silicon Labs chipsets lack encryption, enabling attackers within radio range to compromise vulnerable devices. Firmware updates cannot directly resolve this issue due to a flaw in the Z-Wave specification for these chipsets.

The Impact of CVE-2020-9057

Attackers within radio range can exploit the vulnerability to take control or disrupt Z-Wave devices.
The issue affects Linear's WADWAZ-1 and WAPIRZ-1 versions 3.43, which use vulnerable chipsets.

Technical Details of CVE-2020-9057

This section provides detailed technical insights into the vulnerability.

Vulnerability Description

Z-Wave devices with Silicon Labs 100, 200, and 300 series chipsets lack encryption support, allowing unauthorized access.
Attackers can capture and replay Z-Wave traffic, compromising device security.

Affected Systems and Versions

Linear's WADWAZ-1 and WAPIRZ-1 versions 3.43 are vulnerable due to the use of affected chipsets.
Silicon Labs 100, 200, and 300 series chipsets are impacted, as they do not support encryption.

Exploitation Mechanism

Attackers within radio range can exploit the lack of encryption in vulnerable Z-Wave devices to compromise security.

Mitigation and Prevention

Protecting systems from CVE-2020-9057 requires immediate actions and long-term security practices.

Immediate Steps to Take

Consider upgrading to Z-Wave chipsets that support Security 2 (S2) encryption, like the 500 or 700 series.
Implement additional security measures to mitigate the risk of unauthorized access.

Long-Term Security Practices

Regularly update firmware and software to address security vulnerabilities.
Conduct security assessments and audits to identify and remediate potential weaknesses.

Patching and Updates

As firmware updates cannot directly resolve the vulnerability, consider hardware upgrades to newer chipsets that support encryption.