CVE-2020-28952

An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices.

• CWE-798

• https://developer.athom.com/firmwareRelease Notes, Vendor Advisory
• https://homey.app/en-us/Product, Vendor Advisory
• https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952Third Party Advisory
• https://developer.athom.com/firmwareRelease Notes, Vendor Advisory
• https://homey.app/en-us/Product, Vendor Advisory
• https://yougottahackthat.com/blog/1260/athom-homey-security-static-and-well-known-keys-cve-2020-28952Third Party Advisory

Published

Mar 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28947In MISP 2.4.134, XSS exists in the template element index vi…6.1
• CVE-2020-28948Archive_Tar through 1.4.10 allows an unserialization attack …7.8
• CVE-2020-28949Archive_Tar through 1.4.10 has :// filename sanitization onl…7.8
• CVE-2020-2895Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-28950The installer of Kaspersky Anti-Ransomware Tool (KART) prior…7.8
• CVE-2020-28951libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may…9.8
• CVE-2020-28953In BigBlueButton before 2.2.29, a user can vote more than on…4.3
• CVE-2020-28954web/controllers/ApiController.groovy in BigBlueButton before…5.3
• CVE-2020-28955SugarCRM v6.5.18 was discovered to contain a cross-site scri…5.4
• CVE-2020-28956Multiple cross-site scripting (XSS) vulnerabilities in the S…5.4
• CVE-2020-28957Multiple cross-site scripting (XSS) vulnerabilities in the C…5.4
• CVE-2020-2896Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9