Sonoff NSPanel Pro 120 (NSPanel120PW)

From Wiki-IoT
Revision as of 00:47, 28 October 2026 by Jeandecian (talk | contribs) (Jeandecian moved page SONOFF NSPanel Pro 120 (NSPanel120PW) to Sonoff NSPanel Pro 120 (NSPanel120PW) without leaving a redirect)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

PROVISIONAL CONSERVATIVE SCENARIO — NOT CONFIRMED DEVICE DEFECTS. Unknown items use the upper-bound score by submitter request. The letter grade below is temporary, subject to further evidence and administrator review.



Sonoff NSPanel Pro 120 (NSPanel120PW)
Security Grade
   
     F
   
Calculator v
SONOFF NSPanel Pro 120 (NSPanel120PW)
   Brand: SONOFF 
   Category: Home Hub • Model / Gen: NSPanel Pro 120 (white) NSPanel120PW
   Release Date:  • Status: 
   Classification Date:  • Official Website

Security Evaluation

1. Device Security

Criterion Value Proof Comment
Known hardware tampering Very common [1] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. Physical interfaces and recovery controls are documented.
Known vulnerabilities Very common [2] [3] [4] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {2,3}. Not a demonstrated finding. SONOFF explicitly identifies the 120 Type as affected by CVE-2019-9506 through v4.2.3, fixed in v4.4.0 or later.
Prior attacks Very common 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. No model-matched evidence of involvement in prior IoT attacks was established. Platform incidents or vulnerability demonstrations do not determine this score.
Updatability Rare 🔗 Proof PROVISIONAL ASSUMPTION 2/3; candidates {1,2}. Not a demonstrated finding. The series has repeated updates, including 120-specific fixes. Stable, beta and phased-rollout status must be distinguished.
Category Score Score: 3 / 3

2. System Security

Criterion Value Proof Comment
Authentication with other systems No [5] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. eWeLink account binding and device pairing are documented; credentials and trust for optional integrations need separate verification.
Communications No encryption [6] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. The documented Bluetooth weakness has a version boundary. It does not determine encryption of every other channel.
Storage No encryption 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. Device-flash encryption remains unverified. Data-folder encryption, encrypted backups or firmware-package flags are insufficient evidence for this field.
Category Score Score: 3 / 3

3. User Authentication

Criterion Value Proof Comment
Account management Basic [7] 🔗 Proof PROVISIONAL ASSUMPTION 2/3; candidates {1,2}. Not a demonstrated finding. The release notes document guest restrictions, not a complete local multi-user lifecycle.
Authentication Absent [8] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. eWeLink binding and optional local passcode protection are documented; mandatory authentication for every local operation is not established.
Brute-force protection Absent [9] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. No model-specific local-passcode or portal lockout rule was established. Cloud-account protection cannot substitute for local evidence.
Event logging Absent [10] 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. Smart-security alerts and device-action history do not establish local administrator access-event logging.
Passwords Default/Common/Easy to guess 🔗 Proof PROVISIONAL ASSUMPTION 3/3; candidates {1,2,3}. Not a demonstrated finding. An optional panel passcode differs from the eWeLink account password. Mandatory local setup and complexity requirements remain unverified.
Category Score Score: 3 / 3

Technical Specifications

Property Details
Operating System & App Android 8 family, SONOFF NSPanel Pro firmware (version not fixed) (Companion App: eWeLink App)
Hardware (CPU / GPU) CPU: Quad-core ARM Cortex-A35 • GPU: Mali G31-2EE
Memory & Storage Memory: • Storage:
Power, Battery & Charging Battery: Externally powered; no operating battery specified (RTC backup not assessed) • Power: 100–240 V AC, 50/60 Hz, 0.15 A max (input rating) • Charging: Not applicable to normal external-power operation
Display & Camera Display: 4.7-inch touchscreen, 750×1334 • Camera: External camera viewing; no integrated camera documented
Sound & Connectivity Sound: Built-in microphone and speaker; intercom • Connectivity: 2.4GHz Wi-Fi IEEE802.11b/g/n; Zigbee3.0; eWeLink-Remote integrations depend on firmware
Physical (Dimensions & Mass) Dimensions: 122.5 × 74.5 × 39.5 mm • Mass:


Provisional assessment — not administrator approved

Conservative provisional rating: F; GRAS 9/9.

This is an explicitly assumed upper-bound document-review scenario, not a confirmed dangerousness finding or an administrator-approved classification. On 25 October 2026 the submitter authorized selecting the highest evidence-consistent candidate score for each criterion. A completely unknown item is temporarily scored 3. The selected labels such as Very common, No encryption, No authentication or Absent do NOT establish that those conditions were observed. Unknown is not evidence of absence.

No physical device, installed firmware or actual configuration was inspected. Missing optional hardware parameters remain blank. Administrator-only classification date and calculator-version fields have not been set. The official classification may remain blank until administrator approval.

Scope

采用120型NSPanel120PW;区分NSPanel、NSPanel Pro 86及NSPanel Pro Gen2;不假定装有某版软件。

Calculation

Using the published methodology: ceil(mean of Device 4 criteria)) + ceil(mean of System 3 criteria)) + ceil(mean of User 5 criteria)).

  • Device CATS: 3
  • System CATS: 3
  • User CATS: 3
  • GRAS: 9; provisional grade: F
  • Evidence-consistent outer range before selecting the conservative scenario: 4–9, candidate grades A / A- / B / C / D / F. This is an uncertainty envelope, not a statistical confidence interval.

Criterion assumptions and evidence gaps

Criterion Selected CRIS Candidate scores Basis
device_known_hardware_tampering 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
device_known_vulnerabilties 3 {2, 3} Upper-bound assumption; not a demonstrated defect.
device_prior_attacks 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
device_updatability 2 {1, 2} Upper-bound assumption; not a demonstrated defect.
system_authentication_with_other_systems 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
system_communications 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
system_storage 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
user_authentication_account_management 2 {1, 2} Upper-bound assumption; not a demonstrated defect.
user_authentication_authentication 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
user_authentication_brute_force_protection 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
user_authentication_event_logging 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.
user_authentication_passwords 3 {1, 2, 3} Upper-bound assumption; not a demonstrated defect.

Hardware and date limitations

  • parent_company: Not established; left blank. 未把品牌所有者、制造商或历史投资人直接等同为母公司;可选字段可暂留空
  • release_date: Not established; left blank. 已找到型号资料和手册,未证实精确首销日
  • status: Not established; left blank. 产品页存在不充分证明指定硬件版本仍在售;销售状态可选,待地区/修订状态确认
  • mass: Not established; left blank. 型号文档未确认设备净重;不填包装重量
  • operating_system: Android 8 family, SONOFF NSPanel Pro firmware (version not fixed) 厂商回复区分120与Gen2 Android11;不假定8.1补丁日期
  • memory: Not established; left blank. 未取得型号匹配的官方RAM容量;不挪用SoC理论最大值
  • storage: Not established; left blank. 官方型号资料暂未证实该字段
  • battery: Externally powered; no operating battery specified (RTC backup not assessed) 只描述工作供电方式;不据此断言主板完全没有备份电池
  • charging: Not applicable to normal external-power operation 这是有线供电设备的工作充电字段;不涉及给手机充电或PoE输出
  • camera: External camera viewing; no integrated camera documented 不能将对接摄像头功能写成面板自带摄像头

Basic and hardware sources

Review status

Document review date: 2026-10-25 (Asia/Shanghai). Provisional scenario requested by the submitter. The numerical calculation above is not a claim of administrator approval. The page must be read back after saving; any CAPTCHA, database error, moderation queue, or missing official grade remains an outstanding submission step.