Neato BotVac Connected
From Wiki-IoT
Revision as of 14:47, 27 October 2026 by Jeandecian (talk | contribs)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Neato BotVac Connected | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Neato BotVac Connected
Brand: Neato (Parent: Vorwerk Group) Category: Robot vacuum cleaner • Model / Gen: BotVac Connected (1st connected generation) BotVac Connected Release Date: 2015-12-01 • Status: Classification Date: 2026-10-27 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Very common | 🔗 Proof | Peer-reviewed research bypassed secure boot and extracted firmware and RAM from the robot. Hardware access enables full control. |
| Known vulnerabilities | Very common | 🔗 Proof | Multiple vulnerabilities: weak secret-key generation, buffer overflow, decryptable RSA keys and cloud command execution without authorization. |
| Prior attacks | Rare | 🔗 Proof | Demonstrated by researchers, but no public record of a large botnet using this model. |
| Updatability | None | 🔗 Proof | Neato ceased operations in May 2023 and Neato Cloud services were discontinued in October 2025. No further security updates. |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Cloud API uses per-robot keys, but the research found key-generation and command-channel weaknesses. |
| Communications | Encrypted with obselete encryption | 🔗 Proof | TLS is used, but flawed key generation and the cloud command path undermine it. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Firmware and RAM extraction exposed secrets; RSA private keys could be decrypted. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Single Neato account per robot; no role hierarchy documented. |
| Authentication | Basic | 🔗 Proof | Account login plus robot pairing; no mandatory 2FA. |
| Brute-force protection | Basic | 🔗 Proof | Standard account recovery; no published failed-login threshold. |
| Event logging | Partial logging | 🔗 Proof | Cleaning history and error logs exist; no administrator-access audit trail documented. |
| Passwords | Require change after setup | 🔗 Proof | User sets the account password; no factory default account password. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Neato proprietary firmware (Linux-based) (Companion App: Neato Robotics app (discontinued)) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: • Power: • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: Wi-Fi 2.4 GHz |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
