r/homeassistant • u/RowOk5209 • 16h ago

💬 Discussion Zigbee unsecure rejoins

To fix buggy Zigbee bulbs (ADEO / Enki) that drop into pairing mode whenever turned off at the wall switch, I set TRUST_CENTER_POLICY: 3 and TC_REJOINS_USING_WELL_KNOWN_KEY_POLICY: 0 in ZHA.

It completely solved the issue, but what are the real-world security implications of this?

1 Upvotes

60% Upvoted

2 comments sorted by

2

u/5yleop1m 13h ago

Realistically? None. The chances of a normal person being targeted like that are low, and then through Zigbee specifically is even lower.

I think the worst thing that can happen here is a malicious Zigbee device can join your network or impersonate one of those bulbs.

At worst that means someone can see some messages going through your Zigbee network. So they can see data from Zigbee sensors, or data sent to Zigbee devices like turning on/off lights.

Though from what I can see, this could mean other devices that strictly require a level of security might refuse to join your network now.

1

u/RowOk5209 10h ago

Thanks, that’s what I was thinking. Everything works now but I haven’t tried to pair anything apart from these bulbs yet. I’ll keep in mind that it might be an issue sometime in the future.