description: The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.
problem types: CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
affected:
{
product: Z-Wave
vendor: Silicon Labs
versions:
status: affected, version: S2
}