CVE-2020-28952
📋 TL;DR
Athom Homey and Homey Pro devices use a static, well-known ZigBee network key instead of generating unique keys, allowing attackers to decrypt and potentially inject ZigBee network traffic. This affects all Homey and Homey Pro devices running firmware versions before 5.0.0.
💻 Affected Systems
- Athom Homey
- Athom Homey Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers within ZigBee range can decrypt all ZigBee communications, inject malicious commands to connected smart devices, and potentially take control of the entire smart home ecosystem.
Likely Case
Local attackers can eavesdrop on ZigBee communications between smart devices, potentially gaining access to sensitive information or disrupting device operations.
If Mitigated
With proper network segmentation and physical security, risk is limited to attackers who can physically access the ZigBee network range.
🎯 Exploit Status
Exploitation requires ZigBee radio hardware and knowledge of the static key, but tools for ZigBee packet capture and injection are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.0 and later
Vendor Advisory: https://developer.athom.com/firmware
Restart Required: Yes
Instructions:
1. Open Homey app 2. Go to Settings > System > Update 3. Install firmware update 5.0.0 or later 4. Device will restart automatically
🔧 Temporary Workarounds
Physical Security Enhancement
allLimit physical access to ZigBee network range and monitor for unauthorized ZigBee devices
Network Segmentation
allIsolate Homey device on separate VLAN from critical systems
🧯 If You Can't Patch
- Physically secure the device location to prevent unauthorized ZigBee access
- Consider replacing vulnerable devices with patched versions or alternative products
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Homey app: Settings > System > About. If version is below 5.0.0, device is vulnerable.Check Version:
Not applicable - check via Homey mobile app interfaceVerify Fix Applied:
Verify firmware version is 5.0.0 or higher in Homey app settings. The update generates a unique ZigBee network key.📡 Detection & Monitoring
Log Indicators:
- Unusual ZigBee device enrollments
- Multiple failed ZigBee pairing attempts
Network Indicators:
- Unexpected ZigBee traffic patterns
- ZigBee devices responding to unauthorized commands
SIEM Query:
Not applicable - this is a local hardware vulnerability🔗 References
- https://developer.athom.com/firmware
- https://homey.app/en-us/
- https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952
- https://developer.athom.com/firmware
- https://homey.app/en-us/
- https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952
