CVE-2013-20003

HighCVSS 8.3/10Last modified Jun 16, 2026

Description

Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-327 CWE-338

Affected software

Vendor	Product	Versions
Silicon Labs	Z-Wave	S0
Sierra Designs	Z-Wave	>= S0, < S0

References

https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/Third Party Advisory
https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdfTechnical Description, Third Party Advisory
https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/Exploit, Third Party Advisory
https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/Third Party Advisory
https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdfTechnical Description, Third Party Advisory
https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/Exploit, Third Party Advisory

Timeline

Published: Feb 4, 2022
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-200049.8A flaw was found in StarWind iSCSI target. StarWind service does not limit client connections and allocates memory on each connection attemp CVE-2013-200055.3Qool CMS 2.0 RC2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking log CVE-2013-200067.5Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not p CVE-2013-200077.2Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by in CVE-2013-200086.8Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without CVE-2013-200094.8Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts v CVE-2013-20016.8Buffer overflow in X.org libXxf86vm 1.1.2 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary c CVE-2013-20026.8Buffer overflow in X.org libXt 1.1.3 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code v CVE-2013-20036.8Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow CVE-2013-20046.8The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion dep CVE-2013-20056.8X.org libXt 1.1.3 and earlier does not check the return value of the XGetWindowProperty function, which allows X servers to trigger use of a CVE-2013-20062.1OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaint