I've had 3 Yale deadbolts with Z-wave since 2016 or so and I love them. They use 4 AAs and I don't mind putting in rechargeables a couple times a year. They have an external way to charge them with a 9v battery in an emergency. No physical key so they can't be picked that way. At times in the past I've had problems with Z-wave delays or then losing connection to the controller, but over the last year of using Z-waveJS UI in an LXC they've been solid. Codes can be set up in HA/Z-waveJS UI or on the keypad itself.
this post was submitted on 06 Oct 2025
18 points (100.0% liked)
homeassistant
20300 readers
10 users here now
Home Assistant is open source home automation that puts local control and privacy first.
Powered by a worldwide community of tinkerers and DIY enthusiasts.
Home Assistant can be self-installed on ProxMox, Raspberry Pi, or even purchased pre-installed: Home Assistant: Installation
Discussion of Home-Assistant adjacent topics is absolutely fine, within reason.
If you're not sure, DM @GreatAlbatross@feddit.uk
founded 3 years ago
MODERATORS
I sorta wish the way locks had developed had been the other way around were the standard was the lock in the wall and the hole in the door. Then we would wire them up at this point.
That's a fantastic idea. You'd probably need the controls to be on the door, but I'm sure that could be done with some pogo pins or wireless charging to the wired unit in the wall.
I was thinking like long ago that the key in the wall and a simple static push/pull type handle on the door.
These locks were exploited many years ago, and I don't believe they are considered to be safe.
Mind sharing an article/video on that?
https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/
I really hope the current production isn't vulnerable to an 8 year old exploit.
Sure: https://www.securityweek.com/100-million-iot-devices-possibly-exposed-z-wave-attack/
Also a 2 year old CVE yet to be addressed: https://cvefeed.io/vuln/detail/CVE-2023-26943
Thanks for that, that's good to know. But TBH, I feel much more secure with deadbolts that don't use keys. Here's a video that helped me make up my mind when I got these.
As far as I can tell, CVE-2023-26943 doesn't have anything to do with Z-wave, it looks to be related to RFID.
You mentioned Yale Smart Locks, and that CVE is specific to Yale Smart Locks. Has nothing to do with Z-Wave, but if your lock has a contact reader, it's susceptible.
Just Z-wave here. Thanks though.
You're missing the point here...🤦
Am I?
The one attack vector you provided that actually applies here is something that would require technical experience above what your average thief would reasonably have. But with a keyed deadbolt, a lot of those can be raked, picked, or opened with a Lishi tool.
So yeah, you're right that there's a vulnerability when locks are paired. But that would require someone to either be within range when that happens or to place a battery powered device and pick up that information the next time pairing happens. Pairing doesn't happen very often. I think the last time I paired any of my locks was over a year ago.
But with keyed locks, an attacker wouldn't have to wait for me to do anything, they could just walk up and pick the lock with tools that are easier to get and understand/use.
Going with your reasoning, the two videos I've shared about picking deadbolts would mean that keyed locks aren't secure either.
Two words then: Flipper Zero
You're behind the times on this one. This is a common tool used to defeat all kinds of locks. The Z-Wave exploits have been around for a LOOOONG time now. There's also BT and RFID exploits as well, hence the CVE is posted above.
Mind sharing a link to something showing that the Flipper Zero can actually do anything with Z-wave? Cause all I found are pages that talk about how hard it would be to implement zigbee, let alone*Z-wave:
https://forum.flipper.net/t/zigbee-z-wave-capacity/771
https://old.reddit.com/r/flipperzero/comments/zx05x4/why_cant_we_have_zigbee_support/
I found those two when searching for flipper zero "z-wave" and look what I found right after them, a video dismissing your whole argument about Z-wave devices/locks not being secure:
And why are you bringing up the CVE again? I already said that my locks don't use RFID and they also don't use Bluetooth. You're verging into Straw Man fallacy territory.. I knew there was a reason I had you tagged as a "very upset person".
Lol, classic deflection of someone who insecure in their knowledge about a subject and trying to change the subject. Personal attacks. Weak sauce, guy. Have a time with yourself.
You've shared nothing to make me think anything other than this accusation being projection.
I'll second Yale ZWave door systems. Þey're great, no WiFi needed.
Do you use Home Assistant? If so, any Z-Wave lock will be privacy-respecting. I've only used the Schlage Connect, but it was very reliable. I could change the codes remotely using Z-Wave JS UI.
Just installed the Kwikset HomeConnect 620 deadbolt last weekend. It's a Z-Wave lock, which as others have said makes it independent of ~~someone else's computer~~ the Cloud. It has a keypad using tactile buttons which makes quick no-eyes operation easier. It also has a regular key that can be used in the event the smart features fail. It works with Home Assistant meaning you can operate it remotely if you open the right ports on your router or buy a HA cloud subscription.
The only gotcha is that creating and revoking PIN codes via HA/Z-Wave JS isn't straightforward. You have to go into the developer tools and search for the correct action.