This document describes the security considerations for the esphome-elero component.

The esphome-elero component controls Elero wireless blinds via a CC1101 868 MHz RF transceiver. This involves wireless communication with motor controllers, a web interface for management, and integration with Home Assistant.

Important: The Elero RF protocol was designed for convenience, not security. It provides no meaningful protection against determined attackers with RF equipment.

The Elero protocol uses:

1. Obfuscation, not encryption: The encoding (nibble substitution, XOR, etc.) obscures data but provides no cryptographic security. Anyone with the algorithm can decode packets.

2. Rolling counter: Commands include a counter value, but:

   • The counter is not cryptographically signed
   • Counter sync can be broken by physical remote use
   • No replay protection beyond "recent counter" checks

3. No authentication: Any device that knows the blind address and channel can send commands. There is no shared secret or certificate.

4. Broadcast transmission: All RF commands are broadcast on the shared 868 MHz band. Any receiver within range can capture packets.

• Physical access to original remote: Allows extraction of all necessary parameters
• Passive sniffing: Reveals blind addresses, channels, and command patterns
• Neighborhood attackers: Can potentially control blinds if they capture RF traffic

1. Don't rely on blinds for security: Blinds should not be your only barrier against intruders
2. Physical security: Keep original remotes secure
3. Network isolation: Put ESPHome devices on a separate VLAN if possible
4. Monitor logs: Watch for unexpected blind movements

The web UI at /elero allows requests from any origin (Access-Control-Allow-Origin: *).

Implications:

• Any website loaded in a browser on the same network can make requests to the Elero web API
• This enables easy integration but allows potential cross-site attacks

Mitigations:

• The web UI is only accessible on the local network
• No sensitive credentials are exposed
• Commands only affect blinds (no system access)

The web interface has no authentication by default. Anyone on the local network can:

• View discovered and configured blinds
• Send commands to blinds via WebSocket
• View RF packets and logs in real-time

Mitigations:

• Use the elero_web switch to disable the web UI when not needed
• Restrict network access to trusted devices
• Consider using Home Assistant's authentication instead of direct web UI access

The WebSocket at /elero/ws accepts unauthenticated connections:

There is no rate limiting on WebSocket messages. A malicious client could:

• Flood the device with commands
• Cause excessive RF transmissions
• Potentially interfere with normal operation

The component validates all inputs:

• All snprintf() calls use proper size limits
• Command queues limited to ELERO_MAX_COMMAND_QUEUE (10)

The web server uses moderately large stack buffers:

• JSON response buffers: 512-640 bytes
• Not a security issue, but may cause stack overflow on very constrained devices

When used with Home Assistant's native API:

• Communication is encrypted (if configured)
• Authentication is required
• Commands go through Home Assistant's access control

This is more secure than direct web UI access.

# Use Home Assistant API instead of direct web access
api:
  encryption:
    key: "your-encryption-key"

# Disable web UI when not needed for discovery
switch:
  - platform: elero_web
    name: "Elero Web UI"
    restore_mode: RESTORE_DEFAULT_OFF  # Keep disabled by default

If you discover a security vulnerability:

1. Do not open a public GitHub issue
2. Contact the maintainer directly via GitHub private message
3. Allow time for a fix before public disclosure

Bottom line: This component is suitable for convenience automation of blinds, but should not be relied upon for physical security purposes.