CVE-2020-9057

Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable.

• CWE-311
• CWE-311

• https://doi.org/10.1109/ACCESS.2021.3138768Broken Link
• https://github.com/CNK2100/VFuzz-publicThird Party Advisory
• https://ieeexplore.ieee.org/document/9663293Broken Link
• https://kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
• https://doi.org/10.1109/ACCESS.2021.3138768Broken Link
• https://github.com/CNK2100/VFuzz-publicThird Party Advisory
• https://ieeexplore.ieee.org/document/9663293Broken Link
• https://kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource

Published

Jan 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9051Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9052Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9053Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9054Multiple ZyXEL network-attached storage (NAS) devices runnin…9.8
• CVE-2020-9055Versiant LYNX Customer Service Portal (CSP), version 3.5.2, …5.4
• CVE-2020-9056Periscope BuySpeed version 14.5 is vulnerable to stored cros…5.4
• CVE-2020-9058Z-Wave devices based on Silicon Labs 500 series chipsets usi…8.1
• CVE-2020-9059Z-Wave devices based on Silicon Labs 500 series chipsets usi…6.5
• CVE-2020-9060Z-Wave devices based on Silicon Labs 500 series chipsets usi…6.5
• CVE-2020-9061Z-Wave devices using Silicon Labs 500 and 700 series chipset…6.5
• CVE-2020-9062Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Proba…5.3
• CVE-2020-9063NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do n…7.6