CVE-2020-28952

Опубликовано: 09 мар. 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices.

Ссылки

https://developer.athom.com/firmware
Release Notes
Vendor Advisory
https://homey.app/en-us/
Product
Vendor Advisory
https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952
Third Party Advisory
https://developer.athom.com/firmware
Release Notes
Vendor Advisory
https://homey.app/en-us/
Product
Vendor Advisory
https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:homey:homey_firmware:*:*:*:*:*:*:*:*

Версия до 5.0.0 (исключая)

cpe:2.3:h:homey:homey:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:homey:homey_pro_firmware:*:*:*:*:*:*:*:*

Версия до 5.0.0 (исключая)

cpe:2.3:h:homey:homey_pro:-:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00389

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-798

Связанные уязвимости

GHSA-xx3m-cmqv-q6w6

github

больше 3 лет назад