8.1

CVE-2018-25029

Exploit

The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.

Data is provided by the National Vulnerability Database (NVD)
Silabs ≫ Zgm130s037hgn Firmware Versions2
   Silabs ≫ Zgm130s037hgn Version-
Silabs ≫ Zm5202 Firmware Versions2
   Silabs ≫ Zm5202 Version-
Silabs ≫ Zm5101 Firmware Versions2
   Silabs ≫ Zm5101 Version-
Silabs ≫ Zgm2305a27hgn Firmware Versions2
   Silabs ≫ Zgm2305a27hgn Version-
Silabs ≫ Zgm230sb27hgn Firmware Versions2
   Silabs ≫ Zgm230sb27hgn Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.236
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 4.8 6.5 4.9
AV:A/AC:L/Au:N/C:P/I:P/A:N
CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.