| Aqara Spatial Multi-Sensor FP400
|
|
Security Grade
Calculator v
|
Aqara Spatial Multi-Sensor FP400
Release Date: 2026-09-16 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
No publicly confirmed hardware tampering incidents specifically involving the Aqara Spatial Multi-Sensor FP400 were identified in the reviewed sources as of October 24, 2026. The device uses a compact enclosure with flexible mounting options. However, the absence of published incidents does not establish physical tamper resistance.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No publicly confirmed vulnerability specifically affecting the Aqara Spatial Multi-Sensor FP400 was established from the reviewed sources. The device supports Zigbee and Matter over Thread connectivity. Vulnerabilities affecting its wireless protocols, firmware, or compatible hubs should be assessed separately. The absence of a publicly identified vulnerability does not guarantee that the product is secure.
|
| Prior attacks
|
None
|
🔗 Proof
|
No publicly confirmed cyberattack specifically targeting the Aqara Spatial Multi-Sensor FP400 was established from the reviewed sources as of October 24, 2026. The product was commercially released in September 2026. Security risks involving wireless communication, device commissioning, and connected smart home platforms should still be considered.
|
| Updatability
|
Very common
|
🔗 Proof
|
The Aqara Spatial Multi-Sensor FP400 supports firmware maintenance through the Aqara smart home ecosystem. Aqara's official troubleshooting documentation recommends updating the device firmware to the latest version to improve performance and resolve detection issues. Firmware availability and update procedures may depend on the connected hub and selected wireless protocol.
|
| Category Score
|
Score: 1 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
The Aqara Spatial Multi-Sensor FP400 supports Matter over Thread and Zigbee connectivity. When operating through Matter, device commissioning uses cryptographic device attestation and authenticated session establishment to help verify device identity and prevent unauthorized pairing. The Full classification applies to properly configured Matter operation; the Zigbee configuration requires separate assessment.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The Aqara FP400 supports Matter over Thread, which provides authenticated and encrypted communication between commissioned devices. This helps protect occupancy information and automation commands against unauthorized interception and modification. Security depends on correct commissioning and the connected Matter ecosystem. The encryption properties of all alternative operating modes have not been independently verified.
|
| Storage
|
No encryption
|
🔗 Proof
|
The Aqara FP400 stores firmware and may retain configuration information and spatial sensing settings. However, the reviewed manufacturer documentation does not specify the local flash storage encryption mechanism, key management architecture or whether all locally stored data is encrypted at rest. A definitive storage encryption classification requires additional technical evidence.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The Aqara FP400 is managed through the Aqara Home application and compatible smart home hubs. Users can configure detection zones, sensitivity and automation settings through the associated ecosystem. Account management is primarily provided by the connected application or hub rather than an independent user management interface on the sensor itself.
|
| Authentication
|
Secure
|
🔗 Proof
|
When configured through Matter over Thread, the Aqara FP400 uses the Matter commissioning process, which includes cryptographic device attestation and authenticated session establishment. This helps ensure that the device joins an authorized smart home network. The authentication mechanism applies to device-to-system pairing rather than direct username-and-password login.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
The Aqara FP400 does not provide a conventional local password login interface. Device access is managed through supported wireless commissioning procedures and the associated smart home platform. No FP400-specific documentation confirming rate limiting, account lockout thresholds or protection against repeated unauthorized pairing attempts was established. The Basic classification is provisional.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The Aqara FP400 provides occupancy detection, movement information, people counting and zone-based event data to compatible smart home platforms. These events can be used to trigger automations and notifications. However, comprehensive security audit logging, including failed authentication attempts and administrative changes, has not been established from the reviewed documentation.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The Aqara FP400 is a smart presence sensor without a standalone user password interface. Device commissioning is performed through supported wireless protocols and associated smart home applications. The reviewed documentation does not establish a device-local default password, mandatory initial password change or password complexity policy. Therefore, the three available password classification options do not accurately describe this product.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Proprietary embedded firmware (Companion App: Aqara Home)
|
| Hardware (CPU / GPU)
|
CPU: Not publicly disclosed • GPU: Not publicly disclosed
|
| Memory & Storage
|
Memory: Not publicly disclosed • Storage: Internal firmware storage; capacity not publicly disclosed
|
| Power, Battery & Charging
|
Battery: None • Power: 5V DC, 1A • Charging: Not applicable (USB-C powered device)
|
| Display & Camera
|
Display: None • Camera: None; camera-free 60GHz mmWave radar
|
| Sound & Connectivity
|
Sound: No microphone or speaker specified • Connectivity: Zigbee, Thread, Bluetooth; Matter over Thread
|
| Physical (Dimensions & Mass)
|
Dimensions: 64 × 64 × 29.5 mm • Mass: Not publicly disclosed
|
The Aqara Spatial Multi-Sensor FP400 is an intelligent smart home presence sensor developed by Lumi United Technology Co., Ltd. under the Aqara brand. The device was officially released worldwide on September 16, 2026.
The FP400 uses advanced 60GHz millimeter-wave radar technology with a 4T4R MIMO antenna array and AI-based spatial sensing algorithms. It supports real-time tracking of up to 10 people simultaneously and allows users to configure up to eight custom detection zones.
The device has a 120-degree field of view and can cover an area of up to approximately 10 × 8 meters, depending on installation position. It also includes ambient light sensing capabilities and AI-assisted spatial mapping.
The FP400 supports Zigbee and Matter over Thread, providing interoperability with smart home ecosystems including Aqara Home, Apple Home, Google Home, Amazon Alexa and Home Assistant. Its functionality depends on the selected wireless protocol and compatible controller or hub.
The hardware measures 64 × 64 × 29.5 mm, requires a 5V DC / 1A power supply through USB-C, and has an IPX5 protection rating. The operating temperature range is -10°C to 50°C.
Unlike conventional security cameras, the FP400 does not capture video or images. Its radar-based detection provides occupancy and movement information without visual surveillance.
Security-related capabilities include Matter device commissioning, authenticated and encrypted Matter communication, configurable smart home integrations and firmware maintenance.
This preliminary IDRS security assessment was prepared using publicly available Aqara product specifications, technical documentation and Matter security guidance as of October 24, 2026.
No publicly confirmed model-specific hardware tampering incidents, security vulnerabilities or targeted attacks were established from the reviewed sources.
Detailed local storage encryption, brute-force resistance, security audit logging and password policy enforcement have not been independently verified. These areas require further investigation before a definitive security rating can be assigned.
