title: Z-Wave S0 Decryption Vulnerability in End Devices
description:
The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices. This vulnerability may allow an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.
problem types: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
affected:
{
defaultStatus: affected
packageName: Z-Wave SDK
platforms: [ARM, 32 bit]
product: Z-Wave SDK
repo: https://github.com/SiliconLabs/gecko_sdk/releases
vendor: Silicon Labs
versions:
status: unaffected, version: 7.20.0
status: unaffected, version: 7.19.3
status: unaffected, version: 7.18.8
status: unaffected, version: 7.17.5
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL