ZCOVER: Uncovering Z-Wave Controller Vulnerabilities Through Systematic Security Analysis of Application Layer Implementation

The increasing use of smart home technologies has raised concerns about security vulnerabilities, particularly in Z-Wave systems. Existing approaches hold the promise of assessing Z-Wave security in slave devices but fall short of being effectively applied to discover vulnerabilities in Z-Wave controllers, which are central to Z-Wave systems. We present ZCOVER, a framework for systematically analyzing the application layer of Z-Wave controllers to uncover security vulnerabilities. By extracting the known and unknown properties (e.g., Z-Wave command classes) of the Z-Wave controller and utilizing mutation that considers the correlations of the Z-Wave packet frame fields, ZCOVER can effectively discover unknown vulnerabilities in the target Z-Wave controller. Evaluation on nine real-world Z-Wave devices showed that ZCOVER outperformed existing Z-Wave security research, by discovering 15 previously unknown critical vulnerabilities with 12 new CVE IDs assigned. ZCOVER can be utilized as a resource for ensuring the security of Z-Wave controllers in building a secure Z-Wave smart home.