Review Queue
14 findings awaiting your judgement
ECS30a fuzzed Length field at edge case (Length = 0). Meter responded with valid DefaultResponse and no alert was raised. ProtoCrawler scored as concern due to atypical Length value.
ECS47 Update Tariff command with fuzzed price element. Meter responded with alert 8F30 (Source Does Not Have Authority) instead of expected 8F1E (Integrity check failed). Both alerts are plausible per spec but typically 8F1E is preferred for content-level failures.
CS03 Method A Join with fuzzed device EUI64. No alert was raised by the meter and no security log entries were recorded within the test window. ProtoCrawler flagged the case because expected join-failure alert was absent.
Similar pattern to 1155332/13507 (CS06 with fuzzed RemotePartyID RNG 9 mutation) but the meter sent a partial response before timing out. Partial response decoded as a malformed CS06_response with truncated Originator System Title.
ECS47 Update Tariff with valid signature but fuzzed time-of-use band index. Meter accepted with no alert, leaving tariff in an undefined intermediate state until next reboot.
ECS80 Generic NonCritical Alert with fuzzed Cluster ID = 0xFFFE (reserved). No alert raised; meter accepted command silently.
Test case timed out after 360 seconds during CS06 firmware activation with fuzzed RemotePartyID. Stack trace indicates ZbSimCommunicator dataSendWaitAck timeout. Cannot determine from packet trace alone whether the meter rebooted, hung, or correctly rejected the command without responding.
CS02g executionDateTime fuzz with Random Length=0. Meter rejected with 8F1E. Pattern adjacent to R-006 but with new edge case.
CS04 Unjoin with malformed sequence number. Meter raised 8F30 (Source Does Not Have Authority). Behaviour matches R-010 but in a sub-pattern not yet rule-covered.
CS03 Method A Join with fuzzed device EUI64 byte 7. Silent rejection by meter without alert; no security log entry within 30 seconds.
CS02e Provide Device Certificate command with single 8F4C alert raised 4.2 seconds after command receipt. Per GBCS guidance, mandated alerts should be raised promptly (within 2 seconds is typical). Delay may indicate firmware processing pathway inefficiency.
CS06 Critical with fuzzed Originator Counter at 2^32-1 boundary. Meter responded with 8F1A but did not increment local counter as expected per GBCS §6.2.4.
CS02b alert log timestamp drift of 5.3 seconds vs packet trace timestamp. Drift may be ProtoCrawler async correlation artefact rather than firmware time-skew.