Resource exhaustion in Aeon Labs Zw090-A
CVE-2020-9060
Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages.
EPSS: 0.005 (41.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Aeon Labs Zw090-a — versions 3.95
- Aeotec Zw090-a — versions 3.95
- Fibaro Fgwpb-111 — versions 4.3
- Silabs 500_series_firmware
- Silicon Labs 500 Series — versions all
- Zooz Zen20 — versions 5.03
- Zooz Zen25 — versions 5.03
- Zooz Zst10 — versions 6.04
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cret@cert.org (x_refsource_MISC, Broken Link)
- cret@cert.org (Third Party Advisory, x_refsource_MISC)
- cret@cert.org (x_refsource_MISC, Broken Link)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2020-9060?
- CVE-2020-9060 is a medium-severity vulnerability in Aeon Labs Zw090-A, classified under Origin Validation Error. CVSS score: 6.5/10. Published 2022-01-10.
- How severe is CVE-2020-9060?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2020-9060 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.