CVE-2020-9057 in Z-Wave
Summary
by MITRE • 01/10/2022
Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 01/12/2022
The vulnerability identified as CVE-2020-9057 represents a critical security flaw affecting Z-Wave devices utilizing Silicon Labs 100, 200, and 300 series chipsets. This issue stems from fundamental design limitations within the Z-Wave protocol implementation on these legacy hardware platforms, creating a persistent security weakness that has remained unaddressable through firmware updates. The vulnerability operates at the protocol level rather than as a software bug, making it particularly challenging to remediate since the underlying specification itself lacks proper encryption mechanisms. This flaw directly impacts the confidentiality, integrity, and availability of connected home and industrial devices that rely on these chipsets for wireless communication.
The technical nature of this vulnerability allows an attacker positioned within radio range to exploit the absence of encryption to gain unauthorized control over affected devices or to disrupt their normal operation through denial of service attacks. The lack of encryption support means that all Z-Wave traffic transmitted between devices can be easily intercepted, captured, and replayed by malicious actors. This passive monitoring capability enables attackers to observe device communications and potentially replay captured commands to manipulate device behavior or gain unauthorized access to secured areas. The vulnerability is classified under CWE-310 as "Cryptographic Issues" and specifically relates to the absence of proper encryption mechanisms in the communication protocol stack.
The operational impact of this vulnerability extends beyond simple device compromise to encompass broader security implications for connected environments. Attackers can exploit this weakness to perform unauthorized device control, potentially gaining access to physical security systems, lighting controls, thermostats, and other smart home infrastructure. The replay capability further amplifies the threat potential, allowing attackers to execute previously captured commands at will, creating opportunities for persistent unauthorized access. This vulnerability affects devices in the industrial IoT space and residential automation environments where Z-Wave protocol is commonly deployed, making it particularly concerning for organizations relying on these technologies for security and operational continuity.
The mitigation strategy for this vulnerability requires a fundamental hardware upgrade to newer Silicon Labs chipsets, specifically the 500 and 700 series that support Security 2 (S2) encryption protocols. This represents a hardware-level solution rather than a software patch, as the vulnerability exists at the chipset specification level rather than in firmware implementations. The Linear WADWAZ-1 and WAPIRZ-1 devices with 300 series chipsets serve as concrete examples of vulnerable products, demonstrating how widely this issue affects commercial and residential automation systems. Organizations must evaluate their entire device inventory to identify affected systems and develop migration plans to newer secure chipsets. This vulnerability also aligns with ATT&CK technique T1046 for network service scanning and T1566 for credential harvesting, as attackers can leverage the lack of encryption to gather intelligence and establish persistent access to networked systems. The remediation process involves complete device replacement rather than simple firmware updates, making this vulnerability particularly costly and disruptive for organizations with large deployed Z-Wave networks.