(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Vivo Y36 (V2247)
|
|
Security Grade
Calculator v1
|
vivo Y36
Category: Smartphone • Model / Gen: Y series (2023; 4G) V2247 (Y36 4G; Indian launch specifications)
Release Date: 2023-06-22 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
ChoiceJacking demonstrates physical USB-port access on a vivo Y36 running Android 13 / Funtouch OS 13. This fits the methodology's exposed-port scope. The test device lacked USB-PD data-role switching, limiting some techniques. The regional model code is unspecified; V2247-specific reproduction is unverified. Rare is a provisional qualitative rating, not measured prevalence.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
The paper identifies a USB-consent weakness on its tested Y36. Rare reflects this documented vulnerability family, not a measured low vulnerability rate. The study does not establish that current V2247 firmware is vulnerable; no CVE belonging to another manufacturer is attributed to this phone.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Researchers performed ChoiceJacking on Y36 in a laboratory, obtaining file access; ADB access required USB debugging. This is demonstrated research exploitation, not evidence of a criminal campaign or botnet. The exact regional SKU and present firmware exploitability remain unverified, so Rare is provisional.
|
| Updatability
|
Rare
|
🔗 Proof
|
vivo currently lists Y36 under Regular Security Updates, separately from its monthly and quarterly schedules. The official European update page also maps Y36 to V2247 and lists firmware history. Updates are supported, but a fixed cadence and support end date are not established here. Rare is a provisional middle rating, not a measured release frequency.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Y36 officially supports Bluetooth. Android documents an initial pairing procedure and passcodes where required, supporting partial connection authentication. This is a platform-based assessment, not verification of every Y36 interface. The USB-consent bypass in the cited research also prevents a claim of universal authenticated connections. Current-build mutual authentication across all services is unverified.
|
| Communications
|
No encryption
|
🔗 Proof
|
Android supports modern secure connections and denies cleartext by default for apps targeting API 28+, but apps can explicitly permit HTTP. Because the rubric lacks a mixed-traffic option, No encryption provisionally represents permitted plaintext alongside encrypted traffic. It does not mean all Y36 communication is unencrypted; no packet capture or complete app-traffic audit was performed.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Android requires file-based encryption for devices launching with Android 10 or later and documents modern options including AES-256-XTS and Adiantum. Y36 launched on Android 13. This rating is an inference from platform requirements for stock internal user data, not a measured V2247 cipher configuration. Removable microSD and every firmware partition are outside the claim.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Android documents adding and removing Google or other accounts, while vivo's own account FAQ confirms Google-account removal. These support basic account administration; Google credential recovery is also documented by vivo. Creation and deletion of restricted local users on this exact Y36 build remain unverified, so Full is not claimed. Missing evidence does not establish absence.
|
| Authentication
|
Basic
|
🔗 Proof
|
vivo documents screen-lock credentials and, after a Google-protected reset, verification using the previous lock credential or previously linked Google account. Basic reflects these conditional recovery controls. Exact V2247 signed-firmware and recovery enforcement have not been independently established. This does not mean verified boot is absent or that every reset route requires authentication before erasing data.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
vivo's lock-screen FAQ documents retry delays that increase after repeated incorrect passwords. This supports the existence of throttling. The exact delay schedule was not measured on V2247 and may depend on software. The rating applies when a screen-lock credential is configured; no automatic wipe or permanent lockout is assumed.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Android 13 documents a privacy dashboard showing app permission access and timing, with up to seven days of activity. Since Y36 launched on Android 13, Partial logging is a provisional platform-based inference. Its exact interface and retention on V2247 are unverified. Comprehensive persistent login/file-access auditing is not established and is not asserted absent.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
vivo documents optional screen-lock methods and an option to disable the lock by selecting None. This category reflects an allowed no-lock configuration, not a shared factory password. Mandatory post-setup password rotation and enforced complexity are not established for the consumer configuration. Stronger chosen credentials remain possible; exact managed-device policies are outside this assessment.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Funtouch OS 13 based on Android 13 at launch; installed version not verified (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: Qualcomm Snapdragon 680, up to 2.4 GHz • GPU:
|
| Memory & Storage
|
Memory: 8 GB physical RAM (Indian launch configuration) • Storage: 128 GB internal; microSD slot
|
| Power, Battery & Charging
|
Battery: 5000 mAh typical • Power: Rechargeable battery; USB-C charging • Charging: Up to 44 W FlashCharge
|
| Display & Camera
|
Display: 6.64-inch LCD; 2388 x 1080 FHD+; up to 90 Hz • Camera: Rear: 50 MP f/1.8 + 2 MP bokeh f/2.4; front: 16 MP f/2.0
|
| Sound & Connectivity
|
Sound: • Connectivity: 4G LTE; dual nano SIM; 2.4/5 GHz Wi-Fi; Bluetooth 5.1; USB-C; OTG
|
| Physical (Dimensions & Mass)
|
Dimensions: 164.06 x 76.17 x 8.17 mm (Indian configuration) • Mass: 202 g
|
Assessment scope and uncertainty
Assessment date: 2026-10-23. Literature-based assessment of vivo Y36 (V2247, 4G). The official vivo European update selector identifies Y36(V2247). Technical specifications below use the Indian 8 GB/128 GB launch configuration. The distinct Y36 5G is outside scope. No physical device, packet capture, firmware extraction or exploit reproduction was used.
Historical attack evidence names Y36 and Android 13 / Funtouch OS 13, without a regional model code. Applicability to V2247 and current firmware is unverified. Laboratory attacks are distinguished from criminal campaigns; botnet involvement is not established.
The Methodology has no Unknown option or numeric frequency thresholds. Rare is a provisional qualitative judgement, not measured prevalence. Updates remain officially supported under Regular, but no fixed cadence or end date was established; the middle update rating records this uncertainty. No date or patch level is inferred from an unlabelled build number.
Manufacturer FAQ claims are platform guidance, not a model-specific test report. Storage encryption follows the documented Android launch-version requirement. Bluetooth authentication, account administration and permission-use history combine Android guidance with Y36's documented Android platform; exact firmware behavior remains unverified. No full audit trail, arbitrary restricted-user management, particular cipher choice, signed-recovery guarantee or default enterprise policy is assumed. Missing evidence is never treated as proof of absence.
The communications field has no mixed-traffic option: its selected label means apps may allow plaintext, not that modern encrypted connections are absent. The password field concerns a permitted no-lock configuration and does not assert a universal default password.
Release date is the June 22, 2023 official Indian launch date, not a worldwide first-sale date. Specifications vary regionally: this draft uses the Indian thickness, dual rear cameras and Bluetooth version from the Indian specification page, rather than mixing the global variants. GPU, current sale status, companion-app applicability and unverified sound details are left unspecified.
Duplicate checks: Wiki-IoT searches for Y36 and V2247 returned no results. Galaxy S23 and Xiaomi 12 were excluded because existing records were found.
Additional references
Score calculation
- Device: ceil((2 + 2 + 2 + 2)/4) = 2.
- System: ceil((2 + 3 + 1)/3) = 2.
- User authentication: ceil((2 + 2 + 1 + 2 + 3)/5) = 2.
- Total: 6, corresponding to B under the current Methodology. The classification is a device rating, not an assignment mark.
