Security issue - Disarm with any code.

[AZDane]

May be a misconfiguration on my alarm panel, but hopefully somebody can help.
I can pretty much use ANY code in xxxx and my system will disarm.

concord232_client disarm --master XXXX

If I disarm at the panel I have to use the correct code. Does a separate code has to be programmed for the Superbus 2000 RS232 Module? I browsed the menu, but couldn't find any options for that.

[brianewman]

I would also like to know if this is working as designed. I strongly suspect not. Why require me to enter a master code if any code will work? And how secure is my alarm if anyone can connect to port 5007 and disarm the system with any code?

Of course, I will have to make sure that only Home Assistant can reach port 5007, but that's still sub-optimal from a security standpoint.

[4w4w4w]

same here trying to figure this out

[AZDane]

same here trying to figure this out

Don't think it will fixed and personally I don't consider it that big of a deal. If people can access your network, you have bigger problems. Personally I setup my firewall so only Home Assistant has access to the Pi Zero I'm using to host the client.

[4w4w4w]

any idea how to send panic alarm via the client or from HA?

[AZDane]

It has been a while. Try these:
$ concord232_client alarm-police
$ concord232_client alarm-auxiliary
$ concord232_client alarm-fire
Or direct:
http://127.0.0.1:5007/command?cmd=alarm&option=police
http://127.0.0.1:5007/command?cmd=alarm&option=auxiliary
http://127.0.0.1:5007/command?cmd=alarm&option=fire

Don’t remember if I had to change the code to make it work. I do believe I did some modifications:
https://github.com/AZDane/concord232/tree/AZDane

[AZDane]

I use rest_command to call the urls from within HA

[4w4w4w]

I got your version running, I did
$ concord232_client alarm-police
$ concord232_client alarm-auxiliary
$ concord232_client alarm-fire
in the terminal window, but didnt see them show up in server window debug. So I issued directly, saw them in debug as see below but it didnt activate siren. Any ideas?

2025-02-05 09:27:10,397 _internal INFO 192.168.0.30 - - [05/Feb/2025 09:27:10] "GET /command?cmd=alarm&option=police HTTP/1.1" 200 -

[4w4w4w]

i can switch on siren from keypad by holding down police or fire or auxillary buttons. These commands dont go through to the server as after issuing them I cant see them in the server debug log:

concord232_client command --keys 0x24
concord232_client command --keys 0x0b
concord232_client command --keys 0x0c

But if I issue directly through a browser, like this
http://192.168.0.7:5007/command?cmd=keys&keys=52&group=False
then it works. Do you know if there is a key command to do panic alarm?

[4w4w4w]

and then I incorporated this change that you suggested

concord.py

def soundalarm(self):
self.send_keypress([0x24])
changed api.py

@app.route('/command')
def command():
args = flask.request.args
if args.get('cmd') == 'arm':
option = args.get('option')
if args.get('level') == 'stay':
CONTROLLER.arm_stay(option)
elif args.get('level') == 'away':
CONTROLLER.arm_away(option)
elif args.get('cmd') == 'disarm':
CONTROLLER.disarm(args.get('master_pin'))
elif args.get('cmd') == 'keys':
CONTROLLER.send_keys(args.get('keys'),args.get('group'))
elif args.get('cmd') == 'alarm':
CONTROLLER.soundalarm()
return flask.Response()
and trigger it by:

http://127.0.0.1:5007/command?cmd=alarm

but I issue it through a web browser, with it logging in the server debug as:
2025-02-05 10:11:51,912 _internal INFO 192.168.0.30 - - [05/Feb/2025 10:11:51] "GET /command?cmd=alarm HTTP/1.1" 200 -

but nothing happens

[AZDane]

Have you tried issuing these key commands

0x4c: 'Police Panic',
0x4d: 'Aux. Panic',
0x4e: 'Fire Panic',

[4w4w4w]

Progress made! yes that worked by changing concord.py to keypress 0x4c I activated the siren. Do you know why
concord232_client command --keys 0x4c

isnt working for me to get the same result?

[4w4w4w]

I wonder if I was checking out the wrong branch, I was doing
git clone https://github.com/AZDane/concord232.git
but I think thats the master that wasnt changed

[AZDane]

Yes, that’s likely your problem. It has been a while since I did this, but you are correct that it’s not the master branch you need to use.

[4w4w4w]

Did you figure out if hex can be sent via url? or if I have to hard code it into api.py?

[4w4w4w]

and thank you