CVE-2018-25029

Published: Feb 4, 2022Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.

Affected (5)

Products: Silabs: Zgm130s037hgn Firmware, Zm5202 Firmware, Zm5101 Firmware, Zgm2305a27hgn Firmware, Zgm230sb27hgn Firmware

Silabs

5 products

Zgm130s037hgn Firmware

Zm5202 Firmware

Zm5101 Firmware

Zgm2305a27hgn Firmware

Zgm230sb27hgn Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Silabs Zgm130s037hgn Firmware	Version s2

Running on/with	Platform Versions
Silabs Zgm130s037hgn	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Silabs Zm5202 Firmware	Version s2

Running on/with	Platform Versions
Silabs Zm5202	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Silabs Zm5101 Firmware	Version s2

Running on/with	Platform Versions
Silabs Zm5101	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Silabs Zgm2305a27hgn Firmware	Version s2

Running on/with	Platform Versions
Silabs Zgm2305a27hgn	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Silabs Zgm230sb27hgn Firmware	Version s2

Running on/with	Platform Versions
Silabs Zgm230sb27hgn	All versions

Related CWEs

CWE-757

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

References (4)

https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure

Source: cret@cert.org

Third Party Advisory

https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/

Source: cret@cert.org

ExploitThird Party Advisory

https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.