CVE-2020-9059 : Exploit Details and Defense Strategies

Z-Wave devices using Silicon Labs 500 series chipsets are vulnerable to uncontrolled resource consumption, affecting products like Schlage BE468 and Silicon Labs 500 series.

Understanding CVE-2020-9059

Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption, leading to battery exhaustion. The Schlage BE468 version 3.42 door lock is an example of a vulnerable device that fails open at a low battery level.

What is CVE-2020-9059?

This CVE identifies a vulnerability in Z-Wave devices that utilize Silicon Labs 500 series chipsets, potentially causing battery depletion due to uncontrolled resource consumption.

The Impact of CVE-2020-9059

The vulnerability can lead to severe consequences, such as devices failing open at critical battery levels, compromising security and functionality.

Technical Details of CVE-2020-9059

Z-Wave devices using Silicon Labs 500 series chipsets are affected by uncontrolled resource consumption, impacting specific products and vendors.

Vulnerability Description

The vulnerability stems from the use of S0 authentication in Z-Wave devices, allowing uncontrolled resource consumption that depletes device batteries.

Affected Systems and Versions

Product: Schlage BE468
Vendor: Schlage
Version: 3.42
Product: Silicon Labs 500 series
Vendor: Silicon Labs
Versions: All

Exploitation Mechanism

Attackers can exploit the vulnerability by causing uncontrolled resource consumption, leading to battery exhaustion and potential device failure.

Mitigation and Prevention

To address CVE-2020-9059, immediate steps and long-term security practices are essential.

Immediate Steps to Take

Update affected devices to patched versions if available
Monitor battery levels closely to prevent critical depletion
Implement additional security measures to mitigate risks

Long-Term Security Practices

Regularly update firmware and software of Z-Wave devices
Conduct security assessments and audits to identify vulnerabilities
Educate users on battery management and device security best practices

Patching and Updates

Apply patches provided by vendors promptly to address the vulnerability and enhance device security