Sign-up

ID

VAR-202103-0231


CVE

CVE-2020-28952


TITLE

Athom Homey  and  Homey Pro  Vulnerability in using hard-coded credentials on devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-016318

DESCRIPTION

An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices

Trust: 1.62

sources: NVD: CVE-2020-28952 // JVNDB: JVNDB-2020-016318

IOT TAXONOMY

category:['network device']sub_category:hub

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:homeymodel:proscope:ltversion:5.0.0

Trust: 1.0

vendor:homeymodel:homeyscope:ltversion:5.0.0

Trust: 1.0

vendor:homeymodel:homeyscope: - version: -

Trust: 0.8

vendor:homeymodel:proscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-016318 // NVD: CVE-2020-28952

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-28952
value: HIGH

Trust: 1.0

NVD: CVE-2020-28952
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202103-710
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-28952
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2020-28952
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2020-28952
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2020-016318 // CNNVD: CNNVD-202103-710 // NVD: CVE-2020-28952

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.0

problemtype:Using hardcoded credentials (CWE-798) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-016318 // NVD: CVE-2020-28952

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202103-710

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202103-710

PATCH

title:Top Pageurl:https://homey.app/en-us/

Trust: 0.8

title:Athom Homey and Homey Pro devices Repair measures for trust management problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=144463

Trust: 0.6

sources: JVNDB: JVNDB-2020-016318 // CNNVD: CNNVD-202103-710

EXTERNAL IDS

db:NVDid:CVE-2020-28952

Trust: 2.5

db:JVNDBid:JVNDB-2020-016318

Trust: 0.8

db:CNNVDid:CNNVD-202103-710

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2020-016318 // CNNVD: CNNVD-202103-710 // NVD: CVE-2020-28952

REFERENCES

url:https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952

Trust: 2.4

url:https://developer.athom.com/firmware

Trust: 1.6

url:https://homey.app/en-us/

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-28952

Trust: 1.4

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2020-016318 // CNNVD: CNNVD-202103-710 // NVD: CVE-2020-28952

SOURCES

db:OTHERid: -
db:JVNDBid:JVNDB-2020-016318
db:CNNVDid:CNNVD-202103-710
db:NVDid:CVE-2020-28952

LAST UPDATE DATE

2025-01-30T21:03:19.257000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2020-016318date:2021-11-24T01:36:00
db:CNNVDid:CNNVD-202103-710date:2021-08-16T00:00:00
db:NVDid:CVE-2020-28952date:2024-11-21T05:23:22.197

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2020-016318date:2021-11-24T00:00:00
db:CNNVDid:CNNVD-202103-710date:2021-03-09T00:00:00
db:NVDid:CVE-2020-28952date:2021-03-09T20:15:12.680