FKIE_CVE-2013-20003

Vulnerability from fkie_nvd - Published: 2022-02-04 23:15 - Updated: 2026-06-16 23:52
Severity
8.3 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic.
References
cret@cert.orghttps://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/Third Party Advisory
cret@cert.orghttps://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdfTechnical Description, Third Party Advisory
cret@cert.orghttps://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdfTechnical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/Exploit, Third Party Advisory
Impacted products
Vendor Product Version
silabs zgm130s037hgn_firmware s2
silabs zgm130s037hgn -
silabs zm5202_firmware s2
silabs zm5202 -
silabs zm5101_firmware s2
silabs zm5101 -
silabs zgm2305a27hgn_firmware s2
silabs zgm2305a27hgn -
silabs zgm230sb27hgn_firmware s2
silabs zgm230sb27hgn -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Z-Wave",
          "vendor": "Silicon Labs",
          "versions": [
            {
              "status": "affected",
              "version": "S0"
            }
          ]
        },
        {
          "product": "Z-Wave",
          "vendor": "Sierra Designs",
          "versions": [
            {
              "lessThan": "S0",
              "status": "affected",
              "version": "S0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cret@cert.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:zgm130s037hgn_firmware:s2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAE411D1-DEAB-4251-A7A4-B55492D53AC2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:zgm130s037hgn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "57708CEA-8CF3-4FAF-A7D4-8572EE7A7E53",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:zm5202_firmware:s2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0F01E96-49C5-4FB6-A549-5B25F04B26DB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:zm5202:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "64DAB9DC-A25C-4C7B-8A98-D6AAD3DF46CC",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:zm5101_firmware:s2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D529D8C9-6882-4631-AE7A-E7EE52CA4E73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:zm5101:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D7DA65-1F1E-4C1C-A9EB-16F615E5C34A",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:zgm2305a27hgn_firmware:s2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AC94143-DE93-4179-B4E3-9B684E28A6F0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:zgm2305a27hgn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A86A154-AD74-4EFB-B94A-15C619683EB4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:silabs:zgm230sb27hgn_firmware:s2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE07BCD8-452E-43B4-BC8B-30797A3CF830",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:silabs:zgm230sb27hgn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5794CE0B-4A2F-439F-A6DF-42A710E35D89",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic."
    },
    {
      "lang": "es",
      "value": "Los dispositivos Z-Wave de Sierra Designs (alrededor de 2013) y Silicon Labs (que usan seguridad S0) pueden usar una clave de red conocida y compartida de todos los ceros, lo que permite a un atacante dentro del rango de radio falsificar el tr\u00e1fico Z-Wave"
    }
  ],
  "id": "CVE-2013-20003",
  "lastModified": "2026-06-16T23:52:33.187",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.9,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 5.5,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-02-04T23:15:09.627",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdf"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-327"
        }
      ],
      "source": "cret@cert.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.