Dyson Purifier Big+Quiet Formaldehyde (BP04)

Security Grade

Calculator v

   Brand: Dyson (Parent: Dyson Technology Limited)

   Category: Air purifier and fan (HEPA H13 + K-carbon + SCO filter) • Model / Gen:  BP04

   Release Date: 2023-03-01 • Status: In sale

   Classification Date:  • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	The filter cage opens by hand and exposes the sensor stack, but the electronics sit behind clipped panels with no documented UART or debug header, so tampering leaves visible marks.
Known vulnerabilities	Rare	🔗 Proof	No CVE names this model. Dyson publishes no security advisory feed for purifiers, so the score rests on the absence of a public record rather than on a vendor assurance.
Prior attacks	None	🔗 Proof	No botnet, no CISA KEV entry and no public incident report against Dyson purifiers; the device is not a useful foothold because it holds no credentials beyond its own cloud pairing.
Updatability	Very common	🔗 Proof	Firmware ships over the air through MyDyson and the machine applies it without user action, with the app showing the installed version.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The purifier authenticates only to the owner's MyDyson account; there is no local API, no device certificate the owner can inspect and no way to scope a guest to one machine.
Communications	Encrypted with obselete encryption	🔗 Proof	Cloud traffic uses TLS, but the BLE setup channel has no out-of-band pairing confirmation and Dyson publishes no cipher or protocol detail, so the transport cannot be verified as current.
Storage	No encryption	🔗 Proof	Only calibration data and the Wi-Fi profile are kept in flash, unencrypted and without a secure element; there is no user content at rest, but also no encryption to point at.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	One MyDyson account per household with no roles, no delegated access and no per-device credential.
Authentication	Basic	🔗 Proof	Email and password login only; the app offers no second factor for the account that controls the purifier.
Brute-force protection	Basic	🔗 Proof	The account service rate-limits repeated failures but does not lock the account, and nothing on the device itself counts attempts.
Event logging	Partial logging	🔗 Proof	The app keeps air-quality history and filter life, but no authentication or access log is exposed and nothing can be exported to syslog.
Passwords	Require change after setup	🔗 Proof	Password change is supported with a length requirement, but there is no complexity enforcement and no rotation.
Category Score	Score: 2 / 3

Property	Details
Operating System & App	Proprietary firmware (MyDyson) (Companion App: MyDyson)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 2.4/5 GHz, Bluetooth LE (setup only)
Physical (Dimensions & Mass)	Dimensions: 830 x 434 x 415 mm • Mass: 11.9 kg