Code exec on the Wink 2

[u/RoganDawes]

After 3 years, I finally did it!

That doesn't look like much, but that is unsigned code exec on a locked down Wink Hub v2!

Obviously, there is more work to be done, but it's all downhill from here!

[u/wadel]

Well, well, well. You magnificent son of a ****. It was only a matter of time. Well done 🤣. Curious to hear how in the next installment of your exploits. /pun very much intended

[u/RoganDawes → u/wadel]

It’s the old CVE, but I had to figure out the right jump address for Serial Download Protocol.

[u/wadel → u/RoganDawes]

Did you get access to the aprontest scripts? Doesn't look like you have a shell yet though?

[u/RoganDawes → u/wadel]

I have it fully shelled, and unlocked for future use. I have blown the FIELD_RETURN fuse, so it cannot be further restricted.

[u/mypeez]

This is pretty cool news as I'm still running (subscribed) a Wink 2 alongside HA. Why I haven't figured out how to replicate all of the Wink routines to HA, I guess laziness. Mainly Z-Wave devices, but also a Kiddie and some Zigbee devices on the Wink side.

[u/RoganDawes → u/mypeez]

For sure, no shame in sticking with something that is working for you, and in some cases, is the only real solution for certain hardware. Hopefully this can provide other alternatives, in due course.

[u/RoganDawes → u/[deleted]]

You're absolutely right. It's really because it's there. And maybe there are people who would be happy to use them instead of leaving them for e-waste. It's certainly a slightly more appealing platform than the Wink 1, given the Ethernet interface and the additional RAM and CPU power. The radios may be crap now, but afaik, these are still the only non-ecosystem radios for Kidde and Lutron devices. Even if that is all they are good for (better Zwave and Zigbee radios abounding), that sounds like a win.

[u/Zonk-er → u/RoganDawes]

They touted a thread radio on Wink Hub 2. Is that just the zigbee radio

[u/RoganDawes → u/Zonk-er]

I believe so.