How to receive commands that are intended for the coordinator (TZ-1520)

[RamasyaR]

Question

I need to implement a "universal" device, which being an end device can control other end devices located in the same network.

I have no problems working with standard Zigbee devices. But Tuya devices cause me big problems. Their proprietary protocol is relatively clear to me, but the fact that all the "responses" (which are commands judging by the sniffer logs) go only to 0x0000, i.e. to the coordinator is not clear to me. I need to read the states of the devices, but I do not know how.

Actually, is there any solution to this situation, somehow intercepting traffic on the network going to the coordinator, in order to parse it later? Or maybe some other way to make such devices respond to my address?

I will be satisfied with unproductive solutions, the only thing is that I cannot make the device a coordinator.

Additional context.

The device I work with:
Manufacturer is "_TZE200_e3oitdyu"
Model is "TS0601"
Device link

The code for sending a command to a device (the payload is written based on the example of a command sent from the coordinator via a mobile application):

esp_zb_zcl_custom_cluster_cmd_req_t cmd = {0 };
cmd.address_mode = ESP_ZB_APS_ADDR_MODE_16_ENDP_PRESENT;
cmd.zcl_basic_cmd.src_endpoint = 1;
cmd.zcl_basic_cmd.dst_endpoint = 1;
cmd.zcl_basic_cmd.dst_addr_u.addr_short = ed_data->short_addr;
cmd.profile_id = ESP_ZB_AF_HA_PROFILE_ID;
cmd.cluster_id = 0xEF00;
cmd.custom_cmd_id = 0x00;
cmd.dis_defalut_resp = true;
cmd.direction = ESP_ZB_ZCL_CMD_DIRECTION_TO_SRV;
uint8_t payload[] = {0x00, 0xd0, 0x01, 0x01, 0x00, 0x01, 0x01};
cmd.data.value = payload;
cmd.data.size = sizeof(payload);
cmd.data.type = ESP_ZB_ZCL_ATTR_TYPE_SET,
esp_zb_zcl_custom_cluster_cmd_req(&cmd);

Here is the request that goes to the device, it is processed successfully.

And here is the result that is sent to the coordinator after updating the attribute.