CVE-2020-28952 Hardcoded credentials in n/a
Athom Homey devices use a static, well-known ZigBee network key, allowing attackers to decrypt inter-device communication and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28952?
CVE-2020-28952 is a high-severity vulnerability in n/a, published on 9 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices.
Weakness: CWE-798
Which versions are affected by CVE-2020-28952?
It affects 2 products.
Products include Homey Homey Firmware, Homey Homey Pro Firmware.
How do I fix CVE-2020-28952?
No fix has been published for CVE-2020-28952 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28952 being exploited?
There is no known exploitation of CVE-2020-28952 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xx3m-cmqv-q6w6.