Wireshark give me this message "Encrypted packet decrypted incorrectly (bad MIC)"

[Jema]

I have a Dimplex fireplace with a bluetooth remote control. This remote has an small display

As I want to replace the original remote with my own program controlled by my domotic system I bought a nrf52480 dongle to sniff the traffic between the remote and the fireplace.

I followed all the steps installing the Wireshark software and nrf drivers.

When I run Wireshark I found the Dimplex device, and got all the requests, but when I send the on and off commands on the remote wireshark give me this lines:

Encrypted packet decrypted incorrectly (bad MIC)

Attached is the wireshark fire.

[Vidar Berg]

Hello,

The sniffer trace shows that your master is initiating legacy pairing with a passkey. Did you enter the passkey displayed on the screen into WS?

Sniffing the pairing procedure of a connection 

Best regards,

Vidar

[Jema]

Thanks Vidar,

The remote control and the Dimplex device came already paired, but in the users manual explains that the remote pairs without entering any passkey. Maybe it is stored by default in both devices, but I don't know which is this passkey.

Are there any way to know ?

Thanks

[Jema]

Inside the Dimplex unit there is the Bluetooth module, it has two attached small stickers, one of them can be removed easily, seems it is done for this purpose, both with the same QR code printed. Scanning this QR shows a number like this:

1CBCA850A000 2135

that looks like an 16 byte hex number .... could be some key ???

[Vidar Berg]

It appears that the devices have custom methods for handling passkey input and display then. The format of the QR code does not match the format a passkey. A passkey should be a six-digit number with digits from 0 to 9. E.g., "123456".