(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| HONOR 90 Lite (CRT-NX1)
|
|
Security Grade
Calculator v
|
HONOR 90 Lite
Category: Smartphone • Model / Gen: 90 series (2023) CRT-NX1 (Dual SIM; 8 GB + 256 GB)
Release Date: 2023-07-06 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
ChoiceJacking tested physical USB access on HONOR 90 Lite with Android 13 / MagicOS 7.1. This fits the methodology's exposed-port scope. The paper does not identify CRT-NX1 or demonstrate enclosure or secure-chip tampering. Rare is a qualitative assessment of documented exposure, not measured prevalence.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
The study identifies USB-consent and accessory-mode weaknesses on HONOR 90 Lite, including file access while locked. This is historical test evidence, not confirmation that current firmware remains vulnerable. Exact regional SKU, patch status and overall vulnerability prevalence are unverified; no other vendor's CVE is assigned to this model.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Researchers demonstrated ChoiceJacking against HONOR 90 Lite. File access was possible on the tested locked device; ADB access required an unlocked, development-enabled device. Rare refers to published laboratory exploitation, not an established criminal campaign or botnet. Current-build applicability remains unverified.
|
| Updatability
|
Rare
|
🔗 Proof
|
The current HONOR UK bulletin lists 90 Lite for quarterly updates, but the official UK sales page states a June 2023-June 2025 security-update period. These sources do not establish one consistent support commitment. Rare is a provisional middle rating for documented but uncertain ongoing maintenance; it does not mean no updates exist. No installed patch level was checked.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The model's MagicOS 7.1 guide documents Bluetooth pairing and recipient acceptance of file transfers (printed p.63). These are partial connection controls. The historical USB-consent bypass prevents a universal-authentication claim. Mutual authentication across every interface and the current firmware's USB behavior were not verified.
|
| Communications
|
No encryption
|
🔗 Proof
|
Android supports HTTPS and disables cleartext by default for apps targeting API 28+, while permitting explicit HTTP opt-in. The form has no mixed-traffic option: this provisional label represents possible plaintext alongside encrypted traffic, not absence of encryption on HONOR 90 Lite. No packet capture or complete application-traffic audit was performed.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Android requires file-based encryption on devices launching with Android 10 or later; this model launched on Android 13. HONOR's MagicOS 7.0 white paper also describes XTS-AES-256 file encryption (p.28). This is a platform-based inference for stock internal user data, not a measured CRT-NX1 cipher configuration or a claim covering every partition.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The model guide documents email-account setup (p.55) and changing screen-lock credentials (p.83). Basic reflects the administration explicitly documented. Arbitrary restricted local-user creation and deletion on CRT-NX1 were not verified; this uncertainty does not establish that those functions are absent.
|
| Authentication
|
Basic
|
🔗 Proof
|
The guide documents screen-lock credentials, biometrics and password-only Lockdown (pp.80-83). Basic reflects those verified documentation claims. Signed recovery and authentication for every reset path on CRT-NX1 were not established. The platform white paper discusses secure boot, but this is not a model-specific verification report.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
The MagicOS 7.0 white paper describes increasing delays after incorrect screen-lock passwords (p.27). This supports a platform-based inference that throttling exists on this MagicOS 7.1 model. Exact CRT-NX1 timing and implementation were not tested. A separate secure-storage chip, permanent lockout and automatic data wipe are not assumed.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The model guide explicitly documents reviewing permission-access logs (p.87). This supports Partial logging. A comprehensive, persistent audit trail of logins and file access, its export capability and retention period were not established. Missing documentation is not treated as proof that additional logging is absent.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The guide permits disabling the screen-lock password (p.83). This label represents an allowed no-lock configuration, not a shared factory password. Stronger numeric or hybrid credentials are available; mandatory post-setup rotation and enforced complexity were not established for the consumer configuration.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
MagicOS 7.1 based on Android 13 at launch; current installed build unverified (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: MediaTek Dimensity 6020; 2 x Cortex-A76 2.2 GHz + 6 x Cortex-A55 2.0 GHz • GPU: Mali-G57 MC2
|
| Memory & Storage
|
Memory: 8 GB physical RAM • Storage: 256 GB internal storage
|
| Power, Battery & Charging
|
Battery: 4500 mAh typical; 4400 mAh rated; non-removable Li-ion polymer • Power: Rechargeable battery; USB-C charging • Charging: 22.5 W wired (10 V / 2.25 A), per global specification
|
| Display & Camera
|
Display: 6.7-inch LTPS LCD; 2388 x 1080; up to 90 Hz • Camera: Rear: 100 MP f/1.9 + 5 MP ultrawide/depth f/2.2 + 2 MP macro f/2.4; front: 16 MP f/2.45
|
| Sound & Connectivity
|
Sound: • Connectivity: 5G NR, 4G LTE, 3G WCDMA, 2G GSM; dual nano-SIM; Wi-Fi a/b/g/n/ac 2.4/5 GHz; Bluetooth 5.1; NFC (CRT-NX1); USB-C 2.0; OTG
|
| Physical (Dimensions & Mass)
|
Dimensions: 162.9 x 74.5 x 7.48 mm • Mass: Approximately 179 g, including battery
|
Assessment scope and uncertainty
Assessment date: 2026-10-23. Literature-based assessment of HONOR 90 Lite (CRT-NX1), 8 GB physical RAM and 256 GB storage. The official support selector identifies the Dual SIM CRT-NX1 configuration. No device testing, packet capture, firmware extraction or exploit reproduction was performed.
The HONOR 90 Lite MagicOS 7.1 English User Guide was obtained from the official model support page. Page references use the printed page numbers: email accounts p.55 (PDF p.58), Bluetooth p.63 (PDF p.66), lock-screen controls p.83 (PDF p.86), and permission logs p.87 (PDF p.90). Model documentation is distinguished from the older MagicOS 7.0 platform white paper and Android requirements. Platform-based conclusions remain unverified on a current CRT-NX1 build. No separate secure-storage chip, universal secure reset or full forensic audit trail is assumed.
Historical research names HONOR 90 Lite with Android 13 / MagicOS 7.1, but not its regional model code. The findings are not evidence of present exploitability on every CRT-NX1 firmware. Laboratory exploitation is distinguished from criminal incidents; botnet participation was not established.
Official update sources conflict: the current UK security bulletin includes 90 Lite among quarterly models, while the UK product sales page gives a security-update period ending June 2025. The selected middle update rating records this uncertainty. Actual delivery cadence, latest installed patch and a revised support end date were not verified. The Methodology provides no Unknown option or numeric frequency thresholds; qualitative ratings should not be read as measured incident rates.
The communications label records possible app-permitted plaintext within a mixed Android environment, not a claim that modern encryption is absent. The password label records the documented optional screen lock, not a universal default password. Missing evidence is not interpreted as absence.
Release date uses the official July 6, 2023 global launch announcement, not the earliest sale in any country. Hardware values follow the global specification page. Its charging specification is 22.5 W; the separate UK sales page advertises a 35 W charger, which is not treated as proof of a 35 W handset charging rate. RAM expansion is not counted as physical RAM. Current sale status, companion-app applicability and unverified audio hardware are left unspecified.
Duplicate checks: Wiki-IoT searches for 90 Lite and CRT-NX1 returned no results. Existing iPad Pro 2022 and OPPO A58 records were excluded.
Additional references
Score calculation
- Device: ceil((2 + 2 + 2 + 2)/4) = 2.
- System: ceil((2 + 3 + 1)/3) = 2.
- User authentication: ceil((2 + 2 + 1 + 2 + 3)/5) = 2.
- Total: 6, corresponding to B. This is a device classification, not an assignment mark.
