# Cve-2020-28952

**URL:** <https://community.homey.app/t/cve-2020-28952/45343>\
**Category:** Questions & Help\
**Created:** [March 28, 2021, 7:02am UTC](https://community.homey.app/t/cve-2020-28952/45343 "2021-03-28T07:02:25Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Dijker](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@Dijker](https://community.homey.app/u/Dijker)\
**Post date:** [March 28, 2021, 7:02am UTC](https://community.homey.app/t/cve-2020-28952/45343/1 "2021-03-28T07:02:25Z")

</div>

**Athom Homey Security | Static And Well-Known Keys**  
Do What is this CVE-2020-28952 about:  
`CVE stands for Common Vulnerabilities and Exposures (CVE®)`

> TL;DR: All Homey’s and Homey Pro devices, before version 5.0.0, have a static and well-known ZigBee communications encryption key.

The reporter wrote everything in his blog here:  
[https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952](https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952)

As you could read in the Blog Athom fixed it in the version 5.0.0 Firmware, from then new ZigBee networks are created with a unique Zigbee Network key.

I will try to summarize and answer all questions I see and debunk misconceptions: [Work in Progres]

- Q: I have updated my Homey from a version before v5.0.0, do I have the old Well-Known-Key?  
A: Probably yes, you can Check it [here](https://developer.athom.com/tools/zigbee) if the Network Key is: “01:03:05:07:09:0b:0d:0f:00:02:04:06:08:0a:0c:0d”
- Q: What is the Risk with the Well-Known-Key?  
A: Someone within range of the ZigBee Signal with the knowledge and tools can “break in”, Listen and Control devices on your network. Probably switch Lights and Sockets or read sensor measurements.
- Q: Can I Change the Key?  
A: The only way to change the key is by resetting ZigBee and that would remove all ZigBee devices from Homey. You will have to add all devices again and fix all flows.
- Q: Do I now need to reset my ZigBee network to be secure?  
A: No, even if you reset your network ZigBee is not fully secure. It is your own choice if you think some your neighborhood will try to play with your ZigBee devices, it is just a little bit easier for them if you use the Well-Known-Keys. Decide for yourself if it is worth the hassle.

> I wanted to make an central topic about this as I see reply’s in many other Topics around this with links, assumptions, misinformation etc.  
> To keep other topics clean I moved discussion from other threads on request here.

> Still To be updated

---

_[View the full topic](https://community.homey.app/t/cve-2020-28952/45343)._