We take the security of Klipsch Flexus integration seriously. If you discover a security vulnerability, please follow responsible disclosure practices.

Please DO NOT report security vulnerabilities through public GitHub issues.

Instead, report them privately through GitHub's private vulnerability reporting:

• Go to https://github.com/ilia-ae/klipsch_flexus/security/advisories/new (or Security > Report a vulnerability on the repository page)
• Fill in the details of the vulnerability

This channel is only for security problems. For conduct reports see CODE_OF_CONDUCT.md, and for other questions see SUPPORT.md.

Please provide the following information:

• Type of vulnerability (e.g., authentication bypass, injection, etc.)
• Full paths of affected source files
• Location of the affected code (tag/branch/commit)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability
• Potential fixes (if you have suggestions)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Varies based on severity and complexity

We will acknowledge your report, assess the vulnerability, and work with you to understand and resolve the issue. Once fixed, we will publicly credit you (unless you prefer to remain anonymous).

Security updates will be provided for the latest stable version only. Beta versions (pre-releases vX.Y.Z-beta.N) are for testing and get fixes through the next beta or stable release. Please ensure you're running the most recent version from HACS or GitHub releases.

This integration communicates with your Klipsch Flexus CORE 300 soundbar over your local network using HTTP:

• No Cloud Connection: All communication is local (device → soundbar)
• HTTP Protocol: Reads and volume/mute use unencrypted HTTP. On 2026 firmware the HMAC-signed writes go to the soundbar's HTTPS endpoint, but its certificate is not verified (a LAN device with no public CA), so treat that as unauthenticated transport too
• Local Network Only: The soundbar API should NOT be exposed to the internet

✅ Keep your soundbar on an isolated or trusted network segment

• Consider using VLAN isolation for IoT devices
• Use firewall rules to prevent soundbar from accessing the internet (if desired)

✅ Secure your Home Assistant instance

• Use strong authentication
• Enable HTTPS for Home Assistant UI
• Keep Home Assistant core and all integrations updated
• Review Home Assistant Security Best Practices

✅ Network Recommendations

• Don't expose soundbar ports to the internet
• Don't forward port 80 from your soundbar to external networks
• Use WPA3 encryption for WiFi networks

• This integration uses Home Assistant's built-in authentication system
• No user credentials are stored for the soundbar. On 2026 firmware the write-signing key is derived at runtime from the device MAC (optionally overridden with the Device MAC option); see the Security Assessment, Section 12
• Configuration (host, options such as the Device MAC) is stored in Home Assistant's config entry storage (.storage), which is plain JSON, not encrypted
• Downloaded diagnostics redact the host, every MAC address, the Wi-Fi BSSID, the device ID and stream URLs

• No telemetry: This integration does not send any data outside your local network
• No external APIs: All operations are local HTTP requests
• No cloud dependencies: Works completely offline (after initial setup)

The integration requires:

• Network access to communicate with the soundbar (local only)
• Home Assistant config entry management
• Standard Home Assistant entity creation

This integration has zero external Python dependencies (see manifest.json):

• Uses only Python standard library and Home Assistant built-in libraries
• Reduces attack surface from third-party packages
• Uses aiohttp and cryptography (for 2026-firmware write signing), both provided by Home Assistant core

• Host/IP addresses are validated during config flow
• API responses are validated before processing
• Timeout protections prevent hanging requests

• API errors are caught and logged without exposing sensitive data
• Failed requests are counted and monitored
• Graceful degradation when device is offline

• No use of eval() or exec()
• No shell command execution
• JSON parsing with proper exception handling
• Type hints for all functions (PEP 484)
• Async/await patterns to prevent blocking

A comprehensive security assessment of the Klipsch Flexus CORE 300 soundbar was conducted in February 2026 covering:

• Network port scanning and service enumeration
• API security analysis
• TLS certificate inspection
• Vulnerability assessment (CVE tracking)
• Firmware update status
• Metasploit module testing

Key Findings:

• 11 open TCP ports with no authentication
• Firmware from January 2024 (2+ years old)
• 5 unpatched CVEs (4 High severity)
• Unauthenticated device information disclosure
• TLS certificates and cryptographic keys exposed to local network

📄 Read Full Security Assessment Report

The assessment validates the security limitations described in this document and provides detailed recommendations for network hardening.

• Reads are unauthenticated. Older firmware also accepts every write without authentication; 2026 firmware (1.1.3.x) signs most writes (HMAC_SHA256_AES256), but the key is derived from the device's own MAC (disclosed unauthenticated) and a product-wide constant, so it is not a real security boundary
• Any device on your local network can control the soundbar
• Reads and volume/mute use plain HTTP, and the certificate of the HTTPS write endpoint (2026 firmware) cannot be verified - this is a firmware limitation
• This integration cannot add security features that the hardware doesn't support

These are hardware/firmware limitations, not integration bugs. To mitigate:

1. Keep the soundbar on a trusted network
2. Use network segmentation (VLANs) if possible
3. Don't expose the soundbar to untrusted devices or networks

When security issues are fixed:

1. A patch version will be released immediately
2. A security advisory will be published on GitHub
3. Users will be notified through:
   • GitHub Security Advisories
   • Release notes
   • HACS update notifications

We appreciate the security research community and will credit researchers who responsibly disclose vulnerabilities (with their permission).

• Home Assistant Security
• OWASP IoT Security
• CWE - Common Weakness Enumeration

Last Updated: 2026-11-11
Integration Version: 2.5.21
Security Assessment: Klipsch Flexus CORE 300 Report