Vulnerability-Lookup

GHSA-RCJH-H6HV-XWCC

Vulnerability from github – Published: 2022-01-11 00:01 – Updated: 2022-09-21 00:00

Details

Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-9060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-10T14:10:00Z",
    "severity": "MODERATE"
  },
  "details": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.",
  "id": "GHSA-rcjh-h6hv-xwcc",
  "modified": "2022-09-21T00:00:40Z",
  "published": "2022-01-11T00:01:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9060"
    },
    {
      "type": "WEB",
      "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CNK2100/VFuzz-public"
    },
    {
      "type": "WEB",
      "url": "https://ieeexplore.ieee.org/document/9663293"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/142629"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/142629"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2020-9060 (GCVE-0-2020-9060)

Vulnerability from cvelistv5 – Published: 2022-01-07 04:30 – Updated: 2024-09-16 16:33

Summary

Severity

No CVSS data available.

CWE

CWE-346 - Origin Validation Error
CWE-400 - Uncontrolled Resource Consumption

Assigner

certcc

References

5 references

URL	Tags
https://kb.cert.org/vuls/id/142629	third-party-advisoryx_refsource_CERT-VN
https://ieeexplore.ieee.org/document/9663293	x_refsource_MISC
https://github.com/CNK2100/VFuzz-public	x_refsource_MISC
https://doi.org/10.1109/ACCESS.2021.3138768	x_refsource_MISC
https://www.kb.cert.org/vuls/id/142629	third-party-advisoryx_refsource_CERT-VN

Impacted products

6 products

Vendor	Product	Version
ZooZ	ZEN25	Affected: 5.03
ZooZ	ZEN20	Affected: 5.03
ZooZ	ZST10	Affected: 6.04
Fibaro	FGWPB-111	Affected: 4.3
Silicon Labs	500 series	Affected: all
Aeon Labs	ZW090-A	Affected: 3.95

Date Public

2021-12-27 00:00

Credits

Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:19:19.795Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/142629"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ieeexplore.ieee.org/document/9663293"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CNK2100/VFuzz-public"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
          },
          {
            "name": "VU#142629",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/142629"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ZEN25",
          "vendor": "ZooZ",
          "versions": [
            {
              "status": "affected",
              "version": "5.03"
            }
          ]
        },
        {
          "product": "ZEN20",
          "vendor": "ZooZ",
          "versions": [
            {
              "status": "affected",
              "version": "5.03"
            }
          ]
        },
        {
          "product": "ZST10",
          "vendor": "ZooZ",
          "versions": [
            {
              "status": "affected",
              "version": "6.04"
            }
          ]
        },
        {
          "product": "FGWPB-111",
          "vendor": "Fibaro",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            }
          ]
        },
        {
          "product": "500 series",
          "vendor": "Silicon Labs",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        },
        {
          "product": "ZW090-A",
          "vendor": "Aeon Labs",
          "versions": [
            {
              "status": "affected",
              "version": "3.95"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee"
        }
      ],
      "datePublic": "2021-12-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346 Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-07T23:06:11.000Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://kb.cert.org/vuls/id/142629"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ieeexplore.ieee.org/document/9663293"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CNK2100/VFuzz-public"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
        },
        {
          "name": "VU#142629",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/142629"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "DATE_PUBLIC": "2021-12-27T05:00:00.000Z",
          "ID": "CVE-2020-9060",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ZEN25",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.03"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ZEN20",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "5.03"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ZST10",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "6.04"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ZooZ"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "FGWPB-111",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "4.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Fibaro"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "500 series",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "all"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Silicon Labs"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ZW090-A",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "3.95"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Aeon Labs"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Carlos Nkuba Kayembe, Kim Seulbae, Sven Dietrich, and Heejo Lee"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346 Origin Validation Error"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400 Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.cert.org/vuls/id/142629",
              "refsource": "CERT-VN",
              "url": "https://kb.cert.org/vuls/id/142629"
            },
            {
              "name": "https://ieeexplore.ieee.org/document/9663293",
              "refsource": "MISC",
              "url": "https://ieeexplore.ieee.org/document/9663293"
            },
            {
              "name": "https://github.com/CNK2100/VFuzz-public",
              "refsource": "MISC",
              "url": "https://github.com/CNK2100/VFuzz-public"
            },
            {
              "name": "https://doi.org/10.1109/ACCESS.2021.3138768",
              "refsource": "MISC",
              "url": "https://doi.org/10.1109/ACCESS.2021.3138768"
            },
            {
              "name": "VU#142629",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/142629"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2020-9060",
    "datePublished": "2022-01-07T04:30:28.026Z",
    "dateReserved": "2020-02-18T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:33:05.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-RCJH-H6HV-XWCC

CVE-2020-9060 (GCVE-0-2020-9060)

Tags

Sightings

Nomenclature