Amazon Echo (4th Gen, C7H6T3)

Amazon Echo (4th Gen, C7H6T3)
Security Grade C Calculator v	Amazon Echo (4th Generation, model C7H6T3) Brand: Amazon Category: Smart speaker • Model / Gen: 4th generation C7H6T3 Release Date: 2020-09-24 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	Physical mic-off switch disconnects mics; CVE-2021-37436 documents a post-factory-reset remnant on Echo Dot, a platform-level research finding, not a confirmed exploit of this model.
Known vulnerabilities	Rare	[2] 🔗 Proof	Documented Alexa/Echo platform CVEs: CVE-2022-25809 (AvA audio injection on 3rd/4th gen Echo Dot) and CVE-2021-37436 (post-reset remnant). These are platform-level research CVEs, not model-specific CVEs for C7H6T3, and do not imply current firmware is vulnerable.
Prior attacks	Rare	🔗 Proof	Public security coverage concerns academic research on Echo Dot firmware; no mass in-the-wild botnet or campaign is attributed to this model. Prior attacks is platform-level history.
Updatability	Very common	🔗 Proof	Amazon states Echo devices receive automatic OTA security updates for at least four years after the device is last sold; updates happen automatically when connected.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[3] 🔗 Proof	Device is bound to an Amazon account in the Alexa app and talks to the Amazon cloud; Zigbee/Thread/Sidewalk pairing supports multiple downstream devices, but the assessed profile does not enable per-device mutual cryptographic authentication beyond the Amazon account channel.
Communications	Encrypted with obselete encryption	🔗 Proof	Amazon states all data streamed between an Alexa-enabled device and the cloud is encrypted; the assessed profile uses the default Alexa-over-TLS cloud channel.
Storage	No encryption	[4] 🔗 Proof	Voice history is stored in the user's Amazon cloud account (encrypted in transit); the local flash is not user-accessible and Amazon does not publish a per-partition encryption claim, so the rating is Partial rather than Full.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Alexa app manages Amazon household profiles, voice profiles, device removal and linked accounts; users can delete voice history and remove the device from the account.
Authentication	Basic	🔗 Proof	Access is via Amazon account sign-in in the Alexa app; the assessed profile does not enable optional 2-Step Verification on the Amazon account, so authentication is rated Basic rather than Secure.
Brute-force protection	Basic	🔗 Proof	The device itself exposes no password prompt; protection relies on Amazon account sign-in throttling and risk detection. The assessed profile does not enable optional 2FA, so the rating is Basic.
Event logging	Access event logged	🔗 Proof	Alexa app records voice interaction history with timestamps; users can review and delete entries.
Passwords	Require change after setup with complexity requirements	🔗 Proof	Setup requires signing into an existing Amazon account or creating a new one with Amazon's password complexity policy; the device has no hard-coded default password.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Alexa (Fire OS-based); assessment: current Alexa firmware as of 2026-10-24 (Companion App: Alexa app (Android/iOS))
Hardware (CPU / GPU)	CPU: MediaTek MT8512, dual ARM Cortex-A53 @ 2.0 GHz • GPU:
Memory & Storage	Memory: 1 GB RAM • Storage:
Power, Battery & Charging	Battery: • Power: 30 W AC power adapter (included; 100–240 V AC) • Charging:
Display & Camera	Display: LED light ring (no screen) • Camera:
Sound & Connectivity	Sound: Dolby-tuned speaker with dual-firing speakers; built-in microphones; physical mic-off button • Connectivity: Dual-band Wi-Fi 802.11a/b/g/n/ac (2.4/5 GHz); Bluetooth; built-in Zigbee hub; Amazon Sidewalk bridge; 3.5 mm aux
Physical (Dimensions & Mass)	Dimensions: 144 × 144 × 133 mm (Ø × H) • Mass: 970 g (34.2 oz)

Documentation-based security assessment: Amazon Echo (4th Generation, C7H6T3). Reviewed 2026-10-24.

Documentation-based assessment of a defined Alexa profile. The device is set up through the Alexa app on iOS/Android and bound to a single Amazon account; the Amazon account uses a password with Amazon's complexity policy but optional 2-Step Verification is not enabled in this profile. The default Alexa-over-TLS cloud channel is used; Zigbee hub, Amazon Sidewalk bridge and Bluetooth are enabled in hardware but no additional per-device mutual authentication is declared. The physical mic-off button is retained; when engaged it disconnects the microphones and shows a red ring. Firmware receives automatic OTA updates while connected. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.

Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform-level history; the cited CVEs concern Echo Dot / Alexa platform research, not a confirmed victim record for model C7H6T3, and some predate or overlap the 2020 release. Optional capabilities (e.g. 2FA, per-device Zigbee auth) are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected current firmware remains vulnerable.

Release-date scope: 2020-09-24, the date stated in the body of the US Press Center launch announcement; not asserted to be the earliest worldwide retail date.

Historical vulnerability: CVE-2022-25809 (improper neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot; arbitrary voice command via malicious skill or paired malicious Bluetooth device, aka Alexa versus Alexa). CVE-2021-37436 (Echo Dot devices through 2021-07-02; physical access after factory reset can obtain sensitive information). Both are platform-level Alexa/Echo Dot research findings, not model-specific CVEs for C7H6T3; Amazon has stated mitigations and automatic updates.

No physical device was tested. Keep the configuration and evidence scope with the ratings.

References: Amazon press release — all-new Echo family, 2020-09-24 Echo (4th Gen) retail spec sheet Echo (4th Gen) retail specs — MT8512 and 1 GB RAM B&H — Echo (4th Gen) includes 30 W power adapter Amazon — Alexa myths, encryption and automatic updates Amazon — physical mic-off switch and voice history NVD — CVE-2022-25809 Alexa versus Alexa NVD — CVE-2021-37436 Echo Dot post-reset remnant Ars Technica — Echo Dot factory-reset remnant coverage WikiIoT methodology