Aether-Z

15 of 15 entries

ID	Risk	Title	CVSS	CWE
`AETHZ-001`	INFO	ZigBee Network Key Recovered via Join Intercept Network encryption key intercepted during device join event, enabling full traffic decryption and authenticated injectio...	9.1	—
`AETHZ-002`	INFO	Default Trust Center Link Key (TCLK) in Use ZigBeeAlliance09 well-known TCLK is in use. Any attacker within RF range can decrypt the key transport frame sent during...	9.0	—
`AETHZ-003`	INFO	ZigBee Network Key in Plaintext Configuration Network key found in plaintext in Zigbee2MQTT or gateway configuration file. Any user or process with read access to the...	7.5	—
`AETHZ-004`	INFO	ZigBee Replay Attack Successful Replayed ZCL command frames accepted by target device. Frame counter validation is not enforced or the acceptance window...	7.4	—
`AETHZ-005`	INFO	ZCL Command Injection Successful Authenticated ZCL commands injected using recovered network key. Security-sensitive commands including door lock, alarm ...	9.6	—
`AETHZ-006`	INFO	ZLL Touchlink Device Stolen Target ZigBee Light Link device stolen and joined to an attacker-controlled network using the leaked ZLL Master Key. The...	9.0	—
`AETHZ-007`	INFO	ZLL Touchlink Factory Reset Successful ZLL touchlink factory reset command was accepted by the target device, removing it from its production network. This con...	7.5	—
`AETHZ-008`	INFO	ZigBee Network Denial-of-Service Successful ZigBee network disrupted via PAN-ID conflict flood or association flood. Devices were disconnected from the network or u...	6.5	—
`AETHZ-009`	INFO	ZigBee Network Key Extracted from Device Firmware Network or link key material extracted from ZigBee device firmware via JTAG debug interface or direct flash memory dump....	8.8	—
`AETHZ-010`	INFO	ZigBee Join Window Permanently Open The ZigBee coordinator's join permission window is permanently open, allowing any device to join the network at any time...	7.1	—
`AETHZ-011`	INFO	Unauthenticated ZDO Enumeration ZigBee Device Object (ZDO) enumeration reveals all endpoints, clusters, and device capabilities without requiring the Zi...	5.3	—
`AETHZ-012`	INFO	Hardcoded ZigBee Credentials in Device Firmware Hardcoded network key or link key found in device firmware binary via static analysis. The key is identical across all d...	9.3	—
`AETHZ-013`	INFO	OTA Firmware Update Not Authenticated Over-the-air firmware updates are accepted by the target device without cryptographic signature verification. An attacke...	8.2	—
`AETHZ-014`	INFO	ZigBee Protocol Fuzzing Induced Device Crash Malformed ZigBee protocol frames caused the target device to crash or become unresponsive. Fuzzing of IEEE 802.15.4 MAC ...	7.5	—
`AETHZ-015`	INFO	ZLL Master Key Deployment Detected Target network uses ZigBee Light Link (ZLL) with the publicly-leaked ZLL Master Key, exposing all touchlink commissionin...	9.0	—

Detailed View

INFO AETHZ-001 — ZigBee Network Key Recovered via Join Intercept

Description: Network encryption key intercepted during device join event, enabling full traffic decryption and authenticated injection. The ZigBee trust center transmitted the network key using the default or known Trust Center Link Key (TCLK), allowing passive interception of the key transport frame. An attacker with this key can decrypt all past captured traffic and inject authenticated ZCL commands.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-002 — Default Trust Center Link Key (TCLK) in Use

Description: ZigBeeAlliance09 well-known TCLK is in use. Any attacker within RF range can decrypt the key transport frame sent during device join, recover the active network key, and then decrypt all network traffic or inject authenticated commands. This well-known key is published in the ZigBee specification and is widely available.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-003 — ZigBee Network Key in Plaintext Configuration

Description: Network key found in plaintext in Zigbee2MQTT or gateway configuration file. Any user or process with read access to the gateway host filesystem can extract the key and use it to decrypt all ZigBee traffic or inject authenticated commands. Plaintext key storage in configuration files is a common misconfiguration in home-automation deployments.

CVSS Vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-004 — ZigBee Replay Attack Successful

Description: Replayed ZCL command frames accepted by target device. Frame counter validation is not enforced or the acceptance window is excessively wide. An attacker can capture authenticated ZCL commands (e.g., door unlock, alarm disarm) and replay them at will, bypassing the encryption layer because the MIC is valid for the replayed frame.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

INFO AETHZ-005 — ZCL Command Injection Successful

Description: Authenticated ZCL commands injected using recovered network key. Security-sensitive commands including door lock, alarm disarm, and thermostat override were accepted by target devices. The attacker constructed valid encrypted and authenticated ZCL frames using the recovered network key, bypassing all network-layer security controls.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

INFO AETHZ-006 — ZLL Touchlink Device Stolen

Description: Target ZigBee Light Link device stolen and joined to an attacker-controlled network using the leaked ZLL Master Key. The ZLL Master Key was published in the ZigBee Light Link specification and allows any party to perform touchlink commissioning against any ZLL device within close RF proximity, effectively stealing devices from their production network without requiring the original network key.

CVSS Vector: AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-007 — ZLL Touchlink Factory Reset Successful

Description: ZLL touchlink factory reset command was accepted by the target device, removing it from its production network. This constitutes an effective denial-of-service: the device can no longer communicate with its coordinator and requires manual re-commissioning. The attack requires only close physical proximity (approximately 10–30 cm) and knowledge of the ZLL protocol.

CVSS Vector: AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

INFO AETHZ-008 — ZigBee Network Denial-of-Service Successful

Description: ZigBee network disrupted via PAN-ID conflict flood or association flood. Devices were disconnected from the network or unable to communicate for the duration of the attack. The PAN-ID conflict flood causes the coordinator to change PAN ID, forcing all devices to re-associate. The association flood exhausts the coordinator's association table, preventing legitimate devices from joining.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

INFO AETHZ-009 — ZigBee Network Key Extracted from Device Firmware

Description: Network or link key material extracted from ZigBee device firmware via JTAG debug interface or direct flash memory dump. The key was stored unprotected in flash memory and was recoverable using standard hardware security research tools. A physical attacker can extract this key and use it to compromise all network communications.

CVSS Vector: AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-010 — ZigBee Join Window Permanently Open

Description: The ZigBee coordinator's join permission window is permanently open, allowing any device to join the network at any time. Combined with use of the default TCLK, this allows an attacker to join the network, receive the network key, and then silently monitor or inject traffic. A permanently-open join window is a common misconfiguration in Zigbee2MQTT and other open-source coordinator software.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-011 — Unauthenticated ZDO Enumeration

Description: ZigBee Device Object (ZDO) enumeration reveals all endpoints, clusters, and device capabilities without requiring the ZigBee network key. ZDO requests operate at the network layer and some coordinators respond to unauthenticated ZDO queries, exposing the network topology, device types, supported clusters, and manufacturer information. This information aids targeted attack planning.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

INFO AETHZ-012 — Hardcoded ZigBee Credentials in Device Firmware

Description: Hardcoded network key or link key found in device firmware binary via static analysis. The key is identical across all devices of this model. Any attacker who obtains a firmware image (via OTA update interception, vendor leak, or hardware extraction) can extract the key and use it to compromise all deployments of the same device model worldwide.

CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHZ-013 — OTA Firmware Update Not Authenticated

Description: Over-the-air firmware updates are accepted by the target device without cryptographic signature verification. An attacker with access to the ZigBee network (via recovered network key) can serve a malicious firmware image via the ZigBee OTA Upgrade cluster, replacing the device firmware with attacker-controlled code.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

INFO AETHZ-014 — ZigBee Protocol Fuzzing Induced Device Crash

Description: Malformed ZigBee protocol frames caused the target device to crash or become unresponsive. Fuzzing of IEEE 802.15.4 MAC headers, ZigBee NWK headers, and ZCL payload fields identified inputs that trigger NULL dereferences or assertion failures in the device firmware. Affected devices required a power cycle to recover.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

INFO AETHZ-015 — ZLL Master Key Deployment Detected

Description: Target network uses ZigBee Light Link (ZLL) with the publicly-leaked ZLL Master Key, exposing all touchlink commissioning operations. The ZLL Master Key was disclosed in the publicly-available ZigBee Light Link specification and allows any attacker to derive the per-network encryption key used during touchlink, enabling device theft and factory reset attacks against all ZLL devices on the network.

CVSS Vector: AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N