High severity · published May 7, 2024
CVE-2024-22472
Long S0 frames received by 500 series Z-Wave devices may cause buffer overflow
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
A buffer Overflow vulnerability in Silicon Labs 500 Series Z-Wave devices may allow Denial of Service, and potential Remote Code execution
This issue affects all versions of Silicon Labs 500 Series SDK prior to v6.85.2
running on Silicon Labs 500 series Z-wave devices.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZS
Z-Wave SDK · Silicon Labs
before 6.85.2 · source: vendor
ZS
Z-wave Software Development Kit · Silabs
before 6.85.2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22472
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22472
community.silabs.com
https://community.silabs.com/068Vm000004rZwm
More from Z-Wave SDK
8.8
CVE-2023-51395
Z-Wave S0 Decryption Vulnerability in End Devices
5.3
CVE-2026-89409
Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes
5.1
CVE-2026-89410
Out-of-bounds read in Z-Wave NCP SPI Handler