CVE-2020-9058 : Security Advisory and Response

Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection.

Understanding CVE-2020-9058

This CVE involves vulnerabilities in Z-Wave devices that fail to implement encryption or replay protection, affecting specific products from various vendors.

What is CVE-2020-9058?

CVE-2020-9058 pertains to the lack of encryption and replay protection in Z-Wave devices utilizing Silicon Labs 500 series chipsets with CRC-16 encapsulation.

The Impact of CVE-2020-9058

The vulnerability allows attackers to potentially intercept and manipulate communication between affected Z-Wave devices, compromising the security and privacy of users' smart home systems.

Technical Details of CVE-2020-9058

This section provides detailed technical information about the vulnerability.

Vulnerability Description

Z-Wave devices using Silicon Labs 500 series chipsets and CRC-16 encapsulation, such as Linear LB60Z-1, Dome DM501, and Jasco ZW4201, lack encryption and replay protection mechanisms.

Affected Systems and Versions

Linear LB60Z-1 version 3.5
Dome DM501 version 4.26
Jasco ZW4201 version 4.05
Silicon Labs 500 series (all versions)

Exploitation Mechanism

Attackers can exploit the absence of encryption and replay protection to eavesdrop on and manipulate communications between vulnerable Z-Wave devices.

Mitigation and Prevention

Protecting systems from CVE-2020-9058 requires immediate actions and long-term security practices.

Immediate Steps to Take

Disable and replace affected Z-Wave devices with secure alternatives.
Implement additional encryption and authentication measures in the network.

Long-Term Security Practices

Regularly update firmware and software of smart devices to patch security vulnerabilities.
Monitor network traffic for any suspicious activities or unauthorized access attempts.

Patching and Updates

Check for security updates and patches provided by the device vendors to address the encryption and replay protection issues in the affected Z-Wave devices.