search

JasonCarter80 / concord232

Apache License 2.0
22 stars 18 forks source link

Security issue - Disarm with any code. #14

Open AZDane opened 5 years ago

AZDane commented 5 years ago

May be a misconfiguration on my alarm panel, but hopefully somebody can help. I can pretty much use ANY code in xxxx and my system will disarm.

concord232_client disarm --master XXXX

If I disarm at the panel I have to use the correct code. Does a separate code has to be programmed for the Superbus 2000 RS232 Module? I browsed the menu, but couldn't find any options for that.

brianewman commented 5 years ago

I would also like to know if this is working as designed. I strongly suspect not. Why require me to enter a master code if any code will work? And how secure is my alarm if anyone can connect to port 5007 and disarm the system with any code?

Of course, I will have to make sure that only Home Assistant can reach port 5007, but that's still sub-optimal from a security standpoint.