High severity · published Feb 4, 2022
CVE-2018-25029
The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and…
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZF
Zgm130s037hgn Firmware · Silabs
s2 · source: NVD
ZF
Zgm2305a27hgn Firmware · Silabs
s2 · source: NVD
ZF
Zgm230sb27hgn Firmware · Silabs
s2 · source: NVD
ZF
Zm5101 Firmware · Silabs
s2 · source: NVD
ZF
Zm5202 Firmware · Silabs
s2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25029
Third Party Advisory
https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure
Exploit
https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/
More from Zgm130s037hgn Firmware
8.3
CVE-2013-20003
Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker within radio range to…