Fibaro Wall Plug (FGWP-102)

Fibaro Wall Plug (FGWP-102)
Security Grade B Calculator v1	Fibaro Wall Plug Brand: Fibaro (Parent: Fibar Group S.A.) Category: Smart plug • Model / Gen: Wall Plug (Z-Wave Plus) FGWP-102 Release Date: 2016-01-01 • Status: In sale Classification Date: 2026-10-27 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Sealed plug enclosure with no public teardown showing an exposed programming header; the device has no user serviceable parts.
Known vulnerabilities	Very common	🔗 Proof	No CVE targets the Wall Plug itself, but the device can only be operated through a Fibaro Home Center controller and CVE-2021-20991 (CVSS 9.8, EPSS around 5.4 percent) allows an authenticated user to inject commands and run them as root on Home Center 2 and Home Center Lite.
Prior attacks	None	🔗 Proof	The controller flaw is not listed in CISA KEV and no exploitation of Z-Wave plugs in the wild has been reported.
Updatability	Very common	🔗 Proof	Fibaro delivers over-the-air firmware for Z-Wave devices through the Home Center and publishes regular updates for the controller.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	Z-Wave Plus with S2 security requires the DSK PIN or QR code during inclusion and authenticates the device with AES-128, so a rogue device cannot silently join the network.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Z-Wave S2 uses AES-128 CCM with per-network keys, and the gateway connection is additionally protected by the controller account.
Storage	Encrypted with obselete encryption	🔗 Proof	No vendor documentation of encryption at rest for network keys or configuration stored in the plug.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Home Center accounts allow several users with limited role separation; fine grained per-device permissions are not documented.
Authentication	Secure	🔗 Proof	Inclusion requires physical confirmation plus the device specific DSK, and all access afterwards goes through the authenticated controller session.
Brute-force protection	Basic	🔗 Proof	The five digit DSK PIN is the main shared secret and no failed attempt lockout for the gateway login is documented.
Event logging	Partial logging	🔗 Proof	Home Center records device and scene events, but no complete security audit trail is published.
Passwords	Require change after setup	🔗 Proof	Access depends on the Home Center cloud account; no enforced complexity policy is documented.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded firmware (Z-Wave) (Companion App: Fibaro Home Center / Yubii Home app)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: None • Power: 230 V AC, 50 Hz, 11 A max • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Z-Wave Plus (868.4 MHz EU), requires a Fibaro Home Center or compatible gateway
Physical (Dimensions & Mass)	Dimensions: approx. 43 x 48 x 65 mm • Mass: approx. 70 g

Overall assessment: The Wall Plug is a clear case of a strong endpoint behind a weak controller. As a Z-Wave Plus device with S2 security it requires the DSK PIN or QR code at inclusion, authenticates with AES-128 and uses AES-128 CCM with per-network keys, so the radio layer is well protected and firmware is delivered over the air through the Home Center. The risk comes from the mandatory controller: the plug cannot operate without a Fibaro Home Center, and CVE-2021-20991 (CVSS 9.8) lets an authenticated user inject commands and execute them as root on Home Center 2 and Home Center Lite. That flaw is not in CISA KEV and no in-the-wild exploitation of Z-Wave plugs is reported, which keeps the impact rating moderate, but the dependency means the endpoint inherits the controller's exposure. Weaker points are the undocumented encryption at rest for network keys, the five digit DSK PIN as main shared secret with no documented lockout, and limited event logging.