Turn me on, turn me off: Zigbee assessment in industrial environments

According to Kaspersky, a Securelist piece published on 12 December 2025, the Zigbee protocol is examined through two realistic attack vectors in industrial deployments: spoofed packet injection and coordinator impersonation (rejoin attack). The analysis explains how an attacker can hijack Zigbee communication between a coordinator and an endpoint to toggle a relay, using only Zigbee, with traffic often encrypted at the application layer but headers remaining readable.

It notes that Zigbee relies on AES-128 network and, in some cases, link keys for end-to-end protection, and that the widely known default link key ZigBeeAlliance09 remains a historical risk when left enabled. The report describes a two-phase approach: passively sniffing traffic to decrypt and identify application payloads, then actively crafting and encrypting new packets to reproduce the legitimate commands, while adjusting counters to defeat replay protections.

It also covers strategies such as forcing a rejoin by beacon manipulation, and the practical need to run a real Zigbee coordinator stack on hardware for reliable timing and ACKs, rather than Python-based emulation. Finally, the piece urges adopting installation codes to derive unique link keys and avoiding sole reliance on network-key encryption to strengthen industrial Zigbee security.