HMD Pulse+ (TA-1602)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	[https://www.hmd.com/en_gb/hmd-pulse-plus/specs https://www.hmd.com/en_gb/press/hmd-pulse-press-release 🔗 Proof]	User-repairable battery, display and charging port allow physical modification. Very common/3 is a hardware-access mapping, not an assertion of compromised encryption or a measured attack rate.
Known vulnerabilities	Very common	[https://source.android.com/docs/security/bulletin/2025-11-01 https://www.hmd.com/en_int/security-updates 🔗 Proof]	Android device-type vulnerability history supports a conservative score 3. HMD also disclosed a resolved FOTA cloud misconfiguration; this does not establish affected users, an exploited handset, or exact-model compromise.
Prior attacks	None	[https://www.hmd.com/en_gb/hmd-pulse-plus/specs https://source.android.com/docs/security/bulletin/2025-11-01 🔗 Proof]	Limited manufacturer, Android, NVD and CISA searches on 2026-10-26 found no incident explicitly attributed to this model. None records that search outcome only; unknown incidents remain possible.
Updatability	Rare	[https://www.hmd.com/en_gb/hmd-pulse-plus/specs https://www.hmd.com/en_gb/press/hmd-pulse-press-release 🔗 Proof]	HMD specifies three years of quarterly security updates and two OS upgrades for Pulse+. Rare/2 maps the explicit quarterly cadence.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[https://developer.android.com/privacy-and-security/security-ssl https://developer.android.com/privacy-and-security/security-config 🔗 Proof]	TLS server identity checking is supported; mutual authentication depends on the application. Partial is a scoped architecture assessment, not a verified endpoint inventory.
Communications	Encrypted with up-to-date encryption	[https://developer.android.com/about/versions/10/behavior-changes-all https://developer.android.com/privacy-and-security/security-config 🔗 Proof]	Modern platform TLS supports the stated application-traffic profile. This score does not cover every radio protocol or an application that enables plaintext or ignores certificates.
Storage	Encrypted with up-to-date encryption	[https://source.android.com/docs/security/features/encryption/file-based https://www.hmd.com/en_gb/press/hmd-pulse-press-release https://www.hmd.com/en_gb/hmd-pulse-plus/specs 🔗 Proof]	Android requires FBE for devices launched with Android 10+. Applied here as a stock-platform compliance inference for internal user data; no flash extraction was performed.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[https://support.google.com/android/answer/7664951?hl=en https://www.hmd.com/en_gb/declaration-of-conformity 🔗 Proof]	Service accounts can be added and removed. Basic assesses the personal-owner profile; full local role-based administration and enterprise policy are not assumed.
Authentication	Basic	[https://support.google.com/android/answer/9079129?hl=en https://www.hmd.com/en_gb/declaration-of-conformity 🔗 Proof]	Configured PIN/password screen lock is the assessed control. Basic does not certify the recovery path or every preinstalled component; disabled screen lock falls outside scope.
Brute-force protection	Exist	[https://source.android.com/docs/security/features/authentication/gatekeeper https://www.hmd.com/en_gb/declaration-of-conformity 🔗 Proof]	Gatekeeper throttles failed screen-lock credential checks. This is platform design evidence, not a measured vendor delay or a claim about online account limits.
Event logging	Partial logging	🔗 Proof	Android maintains bounded diagnostic logs. Partial does not imply persistent, complete access auditing or an enterprise-managed deployment.
Passwords	Default/Common/Easy to guess	🔗 Proof	Provisional taxonomy mapping: personal Android permits user-selected credentials and optional lock removal. No shared factory password is alleged. Neither forced post-setup replacement option fits; score 3 is conservative and requires reviewer acceptance.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Android 14 launch platform; official supported HMD firmware (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Assessment scope Documentation assessment dated 26 October 2026; no physical inspection or exploit test. Profile: supported official manufacturer firmware, available patches installed, locked bootloader and a strong screen-lock credential. Communication assessment covers correctly validated TLS 1.2/1.3 application connections; arbitrary apps, cellular signaling, SMS, Bluetooth and plaintext integrations are outside this boundary. Storage means internal user-data flash, not every read-only partition or removable card. Platform compliance is an inference, not device testing. The calculated grade applies only to this stated profile. Qualitative mappings and the password-policy mismatch are disclosed for reviewer consideration.

Exact model and release evidence 2024-04-24 is HMD stated UK retail availability for Pulse+. The UKCA listing identifies TA-1602. This is the separately marketed Pulse+ with a 50 MP main camera, not the 13 MP Pulse or Pulse Pro; the same platform is not treated as independent security-design evidence. Manufacturer release Exact-model / platform evidence.

Scoring interpretation Vector: 3,3,1,2 / 2,1,1 / 2,2,1,2,3. Category ceiling means: 3,2,2; total 7, provisional profile grade C. Labels are qualitative assessor mappings. The password criterion has no exact fit for user-created Android credentials; score 3 does not allege a shared factory password. If this mapping is rejected, treat the total as unresolved.

Vulnerability and attack scope CVE-2025-48593 is Android platform history, not proof this exact SKU is currently exploitable. Check affected components, installed build and patch level. The limited research found no model-attributed in-the-wild incident; this is not evidence of zero attacks.

Practical risk and improvements Camera and synchronized account data can remain exposed through account compromise even when internal storage is encrypted. Secure removable media independently. Install security updates, retain bootloader protection, configure a strong unique screen credential, enable account MFA, use trusted applications and validated TLS, and protect external backups independently.

Originality WikiIoT product-family searches on 2026-10-26 did not identify this product. Pending or unindexed submissions remain possible.

Methodology WikiIoT methodology. Classification date and calculator version are reserved for administrators.

Vendor service issue HMD reported a FOTA cloud infrastructure misconfiguration, resolved 2026-08-28 and disclosed 2026-09-25. Potential data exposure is documented; exploited handsets and affected model lists are not established. Official notice. This service issue is not counted as a confirmed prior device attack.