CVE-2020-9058

HIGH

Silicon Labs 500 Series Firmware - Missing Encryption of Sensitive Data

Title source: llm
STIX 2.1

Description

Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection.

References (5)

Core 5
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://kb.cert.org/vuls/id/142629
Broken Link x_refsource_misc
https://ieeexplore.ieee.org/document/9663293
Broken Link x_refsource_misc
https://doi.org/10.1109/ACCESS.2021.3138768
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/142629

Scores

CVSS v3 8.1
EPSS 0.0030
EPSS Percentile 21.4%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-311
Status published
Products (4)
dome/dm501 4.26
jasco/zw4201 4.05
linear/lb60z-1 3.5
silabs/500_series_firmware
Published Jan 10, 2022
Tracked Since Feb 18, 2026