Improper authorization in ZooZ ZST10
Priority LOW 30CWE-285Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.
Summary
Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages.
Why it matters now
EPSS 0.0078 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZooZ | ZST10 | 6.04 | — | No fix listed | CNA |
| silabs.com | 500 series | all | — | No fix listed | CNA |
| silabs.com | 700 series | all | — | No fix listed | CNA |
| silabs.com | UZB-7 | 7.00 | — | No fix listed | CNA |
| Samsung | STH-ETH-200 | 6.04 | — | No fix listed | CNA |
| Aeon Labs | ZW090-A | 3.95 | — | No fix listed | CNA |
- ZST10 VendorZooZ Affected 6.04 Fixed in — No fix listed CNA
- 500 series Vendorsilabs.com Affected all Fixed in — No fix listed CNA
- 700 series Vendorsilabs.com Affected all Fixed in — No fix listed CNA
- UZB-7 Vendorsilabs.com Affected 7.00 Fixed in — No fix listed CNA
- STH-ETH-200 VendorSamsung Affected 6.04 Fixed in — No fix listed CNA
- ZW090-A VendorAeon Labs Affected 3.95 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:aeotec:zw090-a:3.95:*:*:*:*:*:*:* | 3.95 | Vulnerable | Aeotec |
| cpe:2.3:o:samsung:sth-eth-200:6.04:*:*:*:*:*:*:* | 6.04 | Vulnerable | Samsung |
| cpe:2.3:o:silabs:uzb-7:7.00:*:*:*:*:*:*:* | 7.00 | Vulnerable | silabs.com |
| cpe:2.3:o:zooz:zst10:6.04:*:*:*:*:*:*:* | 6.04 | Vulnerable | ZooZ |
| cpe:2.3:o:silabs:500_series_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | silabs.com |
| cpe:2.3:o:silabs:700_series_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | silabs.com |
- cpe:2.3:o:aeotec:zw090-a:3.95:*:*:*:*:*:*:* Versions 3.95 Vulnerable ·Aeotec
- cpe:2.3:o:samsung:sth-eth-200:6.04:*:*:*:*:*:*:* Versions 6.04 Vulnerable ·Samsung
- cpe:2.3:o:silabs:uzb-7:7.00:*:*:*:*:*:*:* Versions 7.00 Vulnerable ·silabs.com
- cpe:2.3:o:zooz:zst10:6.04:*:*:*:*:*:*:* Versions 6.04 Vulnerable ·ZooZ
- cpe:2.3:o:silabs:500_series_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·silabs.com
- cpe:2.3:o:silabs:700_series_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·silabs.com
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9061
- 2026-10-03 Alias added: GHSA-x3jm-wwj6-rv9v
References
More ZooZ Zst10 vulnerabilities
- TI-2020-07273 Origin validation error in ZooZ ZEN25 CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-9061 · CVE Program
- CVE-2020-9061 · NVD
- FIRST EPSS
- GHSA-x3jm-wwj6-rv9v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences