CVE-2022-24611 in Z-Wave 500
Summary
by MITRE • 05/17/2022
Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/06/2026
The vulnerability identified as CVE-2022-24611 represents a critical denial of service flaw within the Z-Wave S0 NonceGet protocol implementation in Silicon Labs Z-Wave 500 series devices. This weakness specifically targets the secure S0 and S2 network protection mechanisms that form the foundation of Z-Wave's security architecture. The vulnerability enables local attackers to disrupt network operations by crafting malicious S0 NonceGet packets that contain NodeIDs that do not actually exist within the network topology. This issue directly impacts the integrity of the Z-Wave security framework and compromises the availability of protected network communications.
The technical flaw manifests in the protocol's handling of nonce retrieval requests within the S0 encryption context. When a Z-Wave device receives a crafted NonceGet message containing non-existent NodeIDs, the device's processing logic fails to properly validate the referenced node identifiers before attempting to respond to the request. This improper validation creates a condition where the device becomes stuck in a processing loop or enters an error state that prevents it from functioning normally within the network. The vulnerability is particularly dangerous because it operates at the protocol level, affecting the fundamental security mechanisms that protect Z-Wave communications and can cause cascading failures throughout the network.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise the entire Z-Wave network security posture. Local attackers with physical access to the network can exploit this weakness to render entire Z-Wave networks inoperable, effectively blocking legitimate communication between security devices such as locks, sensors, and controllers. The attack vector is particularly concerning because it requires minimal privileges and can be executed from within the device's physical proximity, making it accessible to adversaries with limited technical expertise. This vulnerability directly relates to CWE-129 and CWE-131 within the Common Weakness Enumeration framework, which catalog the weaknesses associated with improper input validation and insufficient validation of input boundaries. The attack pattern aligns with ATT&CK technique T1499.001 which describes network denial of service attacks targeting communication protocols.
Mitigation strategies for this vulnerability require both immediate and long-term approaches to protect affected Z-Wave networks. Device manufacturers should implement firmware updates that include proper validation of NodeIDs in NonceGet requests before processing them, ensuring that only valid identifiers within the network topology are accepted. Network administrators should consider implementing network segmentation to isolate critical Z-Wave devices and limit the potential impact of successful attacks. Additionally, monitoring systems should be deployed to detect anomalous NonceGet traffic patterns that may indicate exploitation attempts. The vulnerability also highlights the importance of robust input validation in security-critical protocols and underscores the need for thorough security testing of cryptographic implementations. Organizations should conduct comprehensive network assessments to identify all affected devices and prioritize remediation efforts based on the criticality of the protected assets. Regular security audits and vulnerability scanning of Z-Wave networks should become standard practice to identify similar weaknesses before they can be exploited by malicious actors.