You do not have permission to edit this page, for the following reasons:
Overall assessment: The Wall Plug is a clear case of a strong endpoint behind a weak controller. As a Z-Wave Plus device with S2 security it requires the DSK PIN or QR code at inclusion, authenticates with AES-128 and uses AES-128 CCM with per-network keys, so the radio layer is well protected and firmware is delivered over the air through the Home Center. The risk comes from the mandatory controller: the plug cannot operate without a Fibaro Home Center, and CVE-2021-20991 (CVSS 9.8) lets an authenticated user inject commands and execute them as root on Home Center 2 and Home Center Lite. That flaw is not in CISA KEV and no in-the-wild exploitation of Z-Wave plugs is reported, which keeps the impact rating moderate, but the dependency means the endpoint inherits the controller's exposure. Weaker points are the undocumented encryption at rest for network keys, the five digit DSK PIN as main shared secret with no documented lockout, and limited event logging. [[Category:Classification]] [[Category:Calculator v1]] [[Category:Fibaro]]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
