Executive brief
The D3D ZX-G12 Wi-Fi Home Security System is vulnerable to radio frequency (RF) replay attacks. This system is used to protect homes and small offices by monitoring wireless door and motion sensors. Because the system does not verify the uniqueness or timing of sensor signals, an attacker nearby can record a wireless signal (such as a door opening) and play it back later to trigger false alarms or potentially manipulate the system's status, undermining the physical security of the premises.
Technical details
The D3D ZX-G12 (v2.1.1) security hub utilizes the 433 MHz ISM band for communication with wireless peripherals like PIR motion detectors and door sensors. The system fails to implement rolling codes, message authentication codes (MACs), or any form of anti-replay protection. Consequently, the alarm hub accepts any RF transmission that matches a known sensor ID without validating freshness or source integrity. An attacker within RF range can use software-defined radio (SDR) or similar tools to capture legitimate sensor frames and replay them at a later time to spoof sensor events, such as triggering a false alarm or resetting a sensor state. No authentication or physical access to the device is required to perform the attack.
Affected products
- D3D Security ZX-G12 Home Security System 2.1.1
Timeline
- 2026-01-12: advisory: Initial NVD publication date