“Chirp Systems has not responded to requests to work with CISA to mitigate this vulnerability.”
Matt Brown decompiled the Chirp app his landlord made mandatory and found passwords and private keys sitting in a file. He reported it in March 2021. Three years later CISA rates it 9.1 for locks on an estimated 50,000 homes, and Chirp still says nothing. His leasing office’s fix was to sell him a $50 key fob. Chirp’s owner RealPage has time to build rent-setting software that states are suing over, just not to rotate a hard-coded key.