Athom Homey Security | Static And Well-Known Keys Do What is this CVE-2020-28952 about: CVE stands for Common Vulnerabilities and Exposures (CVE®) TL;DR: All Homey’s and Homey Pro devices, before version 5.0.0, have a static and well-known ZigBee communications encryption key. The reporter w…

My main issue with the whole affair is that Athom never communicated this issue to its users.

I don’t get it either. They could have promoted it as a step forward, ‘better security’. People would understand imho.

How or where did you get this info? It’s indeed interesting why Athom haven’t communicated this with its users. I would do a zigbee reset, if that’s the only way to fix a security vulnerability. But I do want to hear it from an official source. Edit: just saw this link. So that’s the source. [i…

@Dijker is busy with this, and Athom. He also made a survey to get a somewhat global view and insights. I’ll wait for what he and Athom come up with. And hey, it’s not a very big security risk, only your neighbours or the-script-kid-on-the-block _could- switch your lights on or the garden sprinkler…

I did that many Times without success😩… A solution seem to reset and back un Homey While pressing Alt at a spécific step, ( i can’t fond nom more that post) but As my zigbee works quite well i won’t play with that, as i m afraid of having to re add devics and to have to fix many flows… So …

[image] Peter_Kawa: I’ll wait for what he and Athom come up with Athom already has come up with a solution: when you reset your Zigbee network, you get a new random key.

[image] rvdeijk: I would do a zigbee reset, if that’s the only way to fix a security vulnerability. But I do want to hear it from an official source. [image]

@Dijker is busy with this, and Athom. He also made a survey to get a somewhat global view and insights. Where’s that survey?

[image] [Community Survey] Homey v5 ZigBee Health check and statistics collection (HomeyScript) Questions & Help If you replace the card with a card that sends a notification it could be possible, but you need more specific information (Like the GUID of the us…

[image] Peter_Kawa: And hey, it’s not a very big security risk, only your neighbours or the-script-kid-on-the-block _could- switch your lights on or the garden sprinklers right? The script-kid-on-the-block has the same entrance to your Zigbee network with a random key; just takes a bit longer…

Cve-2020-28952

Questions & Help

Martijn_Hoogenbosch March 28, 2021, 7:51am 22

Topic		Replies	Views
Zigbee issue (5.0.0-rc47) Questions & Help zigbee	42	4710	January 14, 2021
Zigbee fully down Questions & Help zigbee	30	5506	November 10, 2024
Homey don't find zigbee units after last updated to version 10.0.6(09.02.2024) Questions & Help zigbee	108	3880	February 3, 2025
Zigbee issue with Homey Pro 2026 migrated from Homey Pro (Early 2023) using USB Restore Questions & Help bugreport	173	2941	April 13, 2026
Zigbee stopped working/broken Questions & Help zigbee	47	7729	September 6, 2025

Cve-2020-28952

Related topics