CVE-2021-27289
CRITICALKsix Zigbee Smart Home Kit <1.0.3 <1.0.7 - Replay Attack via Frame Counter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-27289. PoCs published by Alejandro Vazquez Vazquez, TheMalwareGuardian.
AI-analyzed exploit summary This script exploits a sequence number validation flaw in Ksix Zigbee devices by forging packets with high sequence numbers to bypass playback protection. It modifies captured Zigbee traffic and replays it to trigger actions like opening doors or turning on lights.
Description
A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame counter field - is improperly implemented. As a result, an attacker within wireless range can resend captured packets with a higher sequence number, which the devices incorrectly accept as legitimate messages. This allows spoofed commands to be injected without authentication, triggering false alerts and misleading the user through notifications in the mobile application used to monitor the network.
Exploits (2)
This script exploits a sequence number validation flaw in Ksix Zigbee devices by forging packets with high sequence numbers to bypass playback protection. It modifies captured Zigbee traffic and replays it to trigger actions like opening doors or turning on lights.
This repository contains a proof-of-concept exploit for CVE-2021-27289, which targets a replay protection bypass vulnerability in Ksix Zigbee devices. The exploit manipulates the sequence number in captured Zigbee packets to spoof events, demonstrated through attack scenarios like user deception and notification flooding.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H