CVE-2020-28952

Vulnerability

Athom Homey and Homey Pro devices prior to version 5.0.0 use a static, well-known ZigBee Standard Network Key for encrypting inter-device communication. The key is the hexadecimal string 01030507090b0d0f00020406080a0c0d, which is human-generated and identical across all devices [2]. This key is intended only for testing purposes but was deployed in production firmware.

Exploitation

An attacker within ZigBee radio range can capture encrypted network traffic using a ZigBee sniffer (e.g., CC25xx receivers and the KillerBee suite) [2]. Because the encryption key is static and publicly known, the attacker can decrypt all captured ZigBee frames without any authentication or prior access to the network. No user interaction is required.

Impact

Successful decryption reveals all ZigBee communication between the hub and enrolled devices, including sensor data, device commands, and configuration messages. This information disclosure could enable further attacks such as replay of commands or unauthorized control of smart home devices. The compromise affects the confidentiality of the entire ZigBee network.

Mitigation

Athom released firmware version 5.0.0 to address this issue. Users should update their Homey or Homey Pro devices to the latest firmware. No workaround exists for unpatched devices. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date.