CVE-2018-19982

CVE-2018-19982 describes a vulnerability in KT MC01507L Z-Wave S0 devices and their associated firmware, stemming from the lack of HPKP implementation. This medium-severity vulnerability (CVSS 5.3) allows an attacker on the same local network to intercept and sniff cleartext communications between the server and the Z-Wave controller, potentially gaining control over connected devices and even obtaining the Z-Wave network key. Exploitation requires an attacker to be on the same local network and use an IP changer to redirect traffic to a proxy server. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.