CVE-2020-9060
Last modified
CVE-2020-9060 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Silabs | 500 Series Firmware | All versions |
| Aeotec | Zw090-A | 3.95 |
| Fibaro | Fgwpb-111 | 4.3 |
| Zooz | Zen20 | 5.03 |
| Zooz | Zen25 | 5.03 |
| Zooz | Zst10 | 6.04 |
References
- https://doi.org/10.1109/ACCESS.2021.3138768Broken Link
- https://github.com/CNK2100/VFuzz-publicThird Party Advisory
- https://ieeexplore.ieee.org/document/9663293Broken Link
- https://kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
- https://doi.org/10.1109/ACCESS.2021.3138768Broken Link
- https://github.com/CNK2100/VFuzz-publicThird Party Advisory
- https://ieeexplore.ieee.org/document/9663293Broken Link
- https://kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/142629Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-9060?
How severe is CVE-2020-9060?
How do I fix CVE-2020-9060?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-9054Multiple ZyXEL network-attached storage (NAS) devices runnin…9.8
- CVE-2020-9055Versiant LYNX Customer Service Portal (CSP), version 3.5.2, …5.4
- CVE-2020-9056Periscope BuySpeed version 14.5 is vulnerable to stored cros…5.4
- CVE-2020-9057Z-Wave devices based on Silicon Labs 100, 200, and 300 serie…8.8
- CVE-2020-9058Z-Wave devices based on Silicon Labs 500 series chipsets usi…8.1
- CVE-2020-9059Z-Wave devices based on Silicon Labs 500 series chipsets usi…6.5
- CVE-2020-9061Z-Wave devices using Silicon Labs 500 and 700 series chipset…6.5
- CVE-2020-9062Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Proba…5.3
- CVE-2020-9063NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do n…7.6
- CVE-2020-9064Huawei smartphone Honor V30 with versions earlier than Oxfor…5.5
- CVE-2020-9065Huawei smart phone Taurus-AL00B with versions earlier than 1…5.5
- CVE-2020-9066Huawei smartphones OxfordP-AN10B with versions earlier than …7.8
Are you affected by CVE-2020-9060?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST