CVE-2025-10693

Executive Summary

CVE-2025-10693 describes a security vulnerability in Silicon Labs' Z-Wave PIR Sensor Reference Design, specifically within the SmartStart Inclusion process. When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor joins the network as a non-secure device. This bypasses the intended security mechanisms of the Z-Wave protocol, potentially allowing an attacker to intercept or manipulate sensor data. The vulnerability affects SiSDK versions v2025.6.0 and v2025.6.1. No public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware-level issue in a Z-Wave sensor reference design.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full CVSS vector has not been assigned by NVD. However, based on the vulnerability description, a preliminary assessment can be made:

• Attack Vector (AV): Adjacent Network (A) - The attacker must be within radio range of the Z-Wave network.
• Attack Complexity (AC): Low (L) - The attack relies on a standard SmartStart failure.
• Privileges Required (PR): None (N) - No prior authentication is needed.
• User Interaction (UI): None (N) - The attack does not require user action.
• Scope (S): Changed (C) - The vulnerable component (sensor) impacts the security of the broader Z-Wave network.
• Confidentiality (C): High (H) - Sensor data (e.g., motion detection) could be exposed.
• Integrity (I): High (H) - An attacker could inject false sensor data.
• Availability (A): Low (L) - The sensor remains functional, but its security is compromised.

Estimated CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L Estimated Base Score: 8.6 (High)

Threat Level: High. The vulnerability allows a downgrade of security, enabling potential eavesdropping and data manipulation.

Deep Dive & Mechanics

The vulnerability lies in the SmartStart Inclusion process of the Z-Wave PIR Sensor Reference Design. SmartStart is a feature that simplifies device onboarding by using a pre-configured DSK (Device Specific Key) to securely include devices. When SmartStart Inclusion fails (e.g., due to a network error, timeout, or DSK mismatch), the sensor should either retry or remain unpaired. However, due to a logic flaw, the sensor falls back to a non-secure inclusion mode, joining the network without encryption.

Mechanism:

1. A Z-Wave PIR sensor attempts SmartStart Inclusion.
2. The inclusion process fails (e.g., the controller does not respond with the correct key).
3. Instead of aborting, the sensor's firmware proceeds with a standard, non-secure inclusion.
4. The sensor joins the network as a non-secure device, meaning all communication is unencrypted.

This allows an attacker within radio range to:

• Sniff sensor data (e.g., motion events).
• Send fake sensor data to the controller.
• Potentially use the sensor as a pivot point for further attacks on the Z-Wave network.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code is in the SmartStart inclusion logic of the Z-Wave PIR sensor firmware within SiSDK v2025.6.0 and v2025.6.1.

Vulnerable Code (Conceptual):

// In the SmartStart inclusion handler
if (smartstart_inclusion_failed()) {
    // Fallback to non-secure inclusion - VULNERABLE
    perform_non_secure_inclusion();
}

Patched Code (Expected):

// In the SmartStart inclusion handler
if (smartstart_inclusion_failed()) {
    // Abort inclusion and retry or report error - PATCHED
    abort_inclusion();
    report_error("SmartStart inclusion failed");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Z-Wave controller (e.g., USB dongle) with Z-Wave SDK.
• A Z-Wave PIR sensor running vulnerable firmware (SiSDK v2025.6.0 or v2025.6.1).
• A computer with Z-Wave PC Controller or similar tool.

Steps:

1. Set up a Z-Wave network with a controller.
2. Place the vulnerable PIR sensor in inclusion mode.
3. Initiate SmartStart Inclusion from the controller.
4. Interfere with the inclusion process (e.g., send a malformed DSK or cause a timeout).
5. Observe that the sensor joins the network as a non-secure device.
6. Use a Z-Wave sniffer (e.g., Z-Wave PC Controller with a sniffer dongle) to capture unencrypted frames.

Example Command (using Z-Wave PC Controller):

// Initiate SmartStart inclusion with a fake DSK
Z-Wave PC Controller -> Inclusion -> SmartStart -> DSK: 00000-00000-00000-00000-00000-00000-00000-00000

Blue Team

Detection:

• Monitor Z-Wave network logs for devices joining without security (S0 or S2).
• Use a Z-Wave sniffer to detect unencrypted frames.
• Check the sensor's inclusion status via the controller's API.

Prevention:

• Disable SmartStart fallback in the sensor firmware if possible.
• Use a Z-Wave controller that enforces secure inclusion only.
• Keep firmware updated (once a patch is available).

Indicators of Compromise (IOCs)

• Network: Z-Wave frames with security class set to "None" or "S0" (legacy) instead of "S2".
• Device: Sensor reporting as "Non-Secure" in the Z-Wave controller's device list.
• Logs: Controller logs showing "Inclusion failed" followed by "Non-secure inclusion successful".

Detection Engineering

YARA Rule

rule CVE_2025_10693_Z_Wave_Non_Secure_Inclusion {
    meta:
        description = "Detects Z-Wave frames indicating non-secure inclusion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10693"
    strings:
        $non_secure = { 01 00 00 00 }  // Example: Z-Wave frame header with security class = None
    condition:
        $non_secure
}

Sigma Rule

title: Z-Wave Non-Secure Device Inclusion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects a Z-Wave device joining the network without security
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10693
logsource:
    product: z-wave
    service: controller
detection:
    selection:
        EventID: 1001  // Example: Device inclusion event
        SecurityClass: "None"
    condition: selection
falsepositives:
    - Legitimate non-secure devices (e.g., old sensors)
level: high

Suricata Rule

alert udp any any -> any any (msg:"CVE-2025-10693 Z-Wave Non-Secure Inclusion"; content:"|01 00 00 00|"; depth:4; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SmartStart fallback: If possible, modify the sensor firmware to abort inclusion on SmartStart failure.
2. Network segmentation: Isolate Z-Wave networks from critical systems.
3. Monitor: Use Z-Wave sniffer tools to detect non-secure devices.

Long-term Fix:

• Apply the official patch from Silicon Labs once released (expected in a future SiSDK version).
• Replace vulnerable sensors with updated hardware/firmware.

Workaround:

• Manually include sensors using standard inclusion (non-SmartStart) with S2 security, if supported.

Valters IT
DevSecOps & Cyber Threat Intelligence