{"cve":"CVE-2018-19982","nvd":{"published":"2018-12-09T19:29:00.483","modified":"2026-06-17T01:50:13.987","status":"Modified","description":"An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controller (HUB) > Node (products which are controlled by HUB). The prerequisite is that the attacker is on the same network as the target HUB, and can use IP Changer to change destination IP addresses (of all packets whose destination IP address is Server) to a proxy-server IP address. This allows sniffing of cleartext between Server and Controller. The cleartext command data is transmitted to Controller using the proxy server's fake certificate, and it is able to control each Node of the HUB. Also, by operating HUB in Z-Wave Pairing Mode, it is possible to obtain the Z-Wave network key.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.3},"cwes":["CWE-295"],"references":["https://github.com/min1233/CVE/blob/master/1","https://github.com/min1233/CVE/blob/master/1"],"products":["powermanager:kt_mc01507l_z-wave_s0_firmware"],"source":"nvd","synced_at":"2026-10-19T20:54:36.112582389+00:00"},"epss":{"cve":"CVE-2018-19982","score":0.00221,"percentile":0.12675,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}