Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages.
CVSS v4.0 Metrics
Exploitability
Attack VectorAdjacent
ComplexityLow
RequirementsPresent
PrivilegesNone
User InteractionNone
Threat
Exploit MaturityPoC
Vulnerable System
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Subsequent System
ConfidentialityNone
IntegrityNone
AvailabilityNone
Supplemental
SafetyNegligible
AutomatableYes
RecoveryAutomatic
Value DensityConcentrated
UrgencyMedium
Change Log
| Date | Source | Changes | Score |
|---|
| 2026-07-21 | PoC | E: U→P | 2.3 → 5.4 |
| 2026-07-21 | nvd | AV: P→A, AC: H→L, PR: H→N, UI: A→N, VA: N→H | 0.0 → 2.3 |
| 2026-07-21 | cve.org | initial, patch: Unavailable | 0.0 |
Affected Software
| Vendor | Product | Version |
|---|
| Aeon Labs | ZW090-A | 3.95 |
| aeotec | zw090-a | 3.95 |
| Samsung | STH-ETH-200 | 6.04 |
| samsung | sth-eth-200 | 6.04 |
| silabs | 500_series_firmware | All versions |
| silabs | 700_series_firmware | All versions |
| silabs | uzb-7 | 7.00 |
| Silicon Labs | 500 series | all |
| Silicon Labs | 700 series | all |
| Silicon Labs | UZB-7 | 7.00 |
| zooz | zst10 | 6.04 |
| ZooZ | ZST10 | 6.04 |
Published: 2022-01-07
