ByteOS Network

NVD Vulnerability Details :

CVE-2020-28952

Analyzed

Source-cve@mitre.org

Published At-09 Mar, 2021 | 20:15

Updated At-17 Mar, 2021 | 18:28

An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

homey>>homey_firmware>>Versions before 5.0.0(exclusive)

cpe:2.3:o:homey:homey_firmware:*:*:*:*:*:*:*:*

homey>>homey>>-

cpe:2.3:h:homey:homey:-:*:*:*:*:*:*:*

homey>>homey_pro_firmware>>Versions before 5.0.0(exclusive)

cpe:2.3:o:homey:homey_pro_firmware:*:*:*:*:*:*:*:*

homey>>homey_pro>>-

cpe:2.3:h:homey:homey_pro:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-798	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://developer.athom.com/firmware	cve@mitre.org	Release Notes Vendor Advisory
https://homey.app/en-us/	cve@mitre.org	Product Vendor Advisory
https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952	cve@mitre.org	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History