Samsung SmartThings Hub v2 (STH-ETH-200)
From Wiki-IoT
Revision as of 23:47, 28 October 2026 by Jeandecian (talk | contribs)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Samsung SmartThings Hub v2 (STH-ETH-200) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Samsung SmartThings Hub v2
Brand: Samsung SmartThings (Parent: Samsung Electronics Co., Ltd.) Category: Smart home hub • Model / Gen: 2nd STH-ETH-200 Release Date: 2015-04-01 • Status: End of life Classification Date: 2026-10-28 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Teardown and hardware modification are feasible, but large-scale tampering is rare |
| Known vulnerabilities | Very common | 🔗 Proof | Multiple vulnerabilities including insecure local API and credential exposure |
| Prior attacks | Rare | 🔗 Proof | Research exploits exist, mass real-world attacks are uncommon |
| Updatability | Rare | 🔗 Proof | End of life, Samsung no longer provides new security firmware updates |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Full | 🔗 Proof | Integrates fully with SmartThings cloud and Samsung ecosystem |
| Communications | Encrypted with obselete encryption | 🔗 Proof | Early firmware uses outdated TLS versions and weak encryption for local traffic |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Stored device credentials use old encryption algorithms |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Complete account and device management inside SmartThings app |
| Authentication | Basic | 🔗 Proof | Basic password authentication, 2FA support was not available on this old hub |
| Brute-force protection | Absent | 🔗 Proof | No native rate limiting to block brute force login attempts |
| Event logging | Partial logging | 🔗 Proof | Basic device state events logged, fine-grained access audit logs are missing |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | Cloud account enforces password complexity rules |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | SmartThings proprietary firmware (Companion App: SmartThings) |
| Hardware (CPU / GPU) | CPU: Not publicly disclosed • GPU: Not publicly disclosed |
| Memory & Storage | Memory: Not publicly disclosed • Storage: Not publicly disclosed |
| Power, Battery & Charging | Battery: None • Power: DC 5 V power adapter • Charging: Not applicable |
| Display & Camera | Display: None • Camera: None |
| Sound & Connectivity | Sound: None • Connectivity: Wi‑Fi 2.4 GHz, Ethernet, Zigbee, Z-Wave |
| Physical (Dimensions & Mass) | Dimensions: 130 × 130 × 28 mm • Mass: 190 g |
This is an EOL smart home hub supporting Zigbee and Z-Wave. It contains multiple known vulnerabilities. It uses obsolete encryption for local communications and stored credentials, without brute force protection.
