CVE-2022-24611
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows a local attacker to block S0/S2 protected Z-Wave networks by sending crafted S0 NonceGet packets that exploit included but absent NodeIDs.
Risk Assessment
This DoS attack can cause persistent disruption of Z-Wave communication, disabling IoT devices such as locks, sensors, or lighting, posing risks to physical security and operational continuity.
Recommendation
Update the firmware of Z-Wave 500 series devices to a patched version and implement filtering of S0 NonceGet packets on Z-Wave gateways.
Original NVD description (English source)
Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs.