A continuous security assessment of a smart home lab — a standing environment from my master's thesis project, tested with the owner's permission on an isolated network: an AVM Fritz!Box, a QNAP NAS, a RaspberryMatic-based HomeMatic CCU, an AMS smart-meter bridge, and a Home Assistant instance. The whole environment is run through the Red Code platform — the thesis scaffold provides the stage pipeline and note funnel, the harness provides the operator discipline.
Headline result
The HomeMatic CCU's two XML-RPC interfaces accept commands with no authentication. Enumerating through them reached every paired device in the lab — 37 in total: smoke detectors (alarm state readable), wall and radiator thermostats (setpoints writable), floor heating controllers, blind actuators, plug switches, and a motion detector that doubles as an occupied-home oracle. A known design flaw (CVE-2019-9583) that is still the default in 2026; CVSS 9.6 in the adjacent-network context, mapped to OWASP ISTG.
Supporting findings: phpinfo() as the QNAP's default web page, unauthenticated JSON endpoints on the AMS energy bridge exposing household presence patterns, and username disclosure via the Fritz!Box login endpoint. Exact payloads and endpoints stay in the lab's gadget files, not on this site.
Status
The smart home lab phase is done — the thesis has since moved on to a new lab environment: a power transformer substation, taking the same Red Code platform into the OT domain. The external-path question (unauthenticated Home Assistant access, then pivot toward the CCU) remains open, as do the AFL++ and Atheris fuzzing streams.
Links
- Blog write-up: 37 devices, zero passwords: auditing my own smart home
- Platform: Red Code