Vulnerability Details CVE-2018-25029
The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 27.6%
CVSS Severity
CVSS v3 Score 8.1
CVSS v2 Score 4.8
References
- https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure
- https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/
- https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure
- https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/
Products affected by CVE-2018-25029
-
cpe:2.3:h:silabs:zgm130s037hgn:-
-
cpe:2.3:h:silabs:zgm2305a27hgn:-
-
cpe:2.3:h:silabs:zgm230sb27hgn:-
-
cpe:2.3:h:silabs:zm5101:-
-
cpe:2.3:h:silabs:zm5202:-
-
cpe:2.3:o:silabs:zgm130s037hgn_firmware:s2
-
cpe:2.3:o:silabs:zgm2305a27hgn_firmware:s2
-
cpe:2.3:o:silabs:zgm230sb27hgn_firmware:s2
-
cpe:2.3:o:silabs:zm5101_firmware:s2
-
cpe:2.3:o:silabs:zm5202_firmware:s2