Z-Wave JS

Z-Wave JS keeps secure pairing tied to the chosen device

Messages from another node cannot satisfy the exchange that establishes its security keys.

By OHF Daily · Automated reporting

With work by

AlCalzone1 linked pull request

Z-Wave JS checks that messages establishing an S2 secure connection come from the device being paired. Another node can no longer satisfy those waiting steps by supplying key-exchange or completion commands.

The driver also rejects invalid public keys, retrieves only the keys both requested and granted, and verifies that the final completion message uses the temporary pairing key.

From the source

zwave-js/zwave-js

fix: harden S2 message parsing and bootstrapping