| AirGradient ONE (I-9PSL)
|
|
Security Grade
Calculator v1
|
AirGradient ONE
Release Date: 2023-10-21 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Qualitative physical-access assessment: the accessible BOOT button and USB-C data port support firmware flashing and configuration erasure. Power or USB access therefore allows local disruption or software replacement. Rare reflects the physical-access prerequisite, not an observed attack-frequency statistic or proof of a tamper-resistant enclosure.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Isolated documented design weakness: in March 2025 the manufacturer acknowledged that hotspot fallback after network/power failure could permit unauthorized Wi-Fi reconfiguration and opened a firmware-hardening issue. This is historical design evidence, not a claim of a current CVE or widespread exploitation.
|
| Prior attacks
|
None
|
🔗 Proof
|
No confirmed model-specific malicious attack or successful research exploitation was identified in focused AirGradient, independent research, NVD and CISA KEV searches on 2026-10-23. NVD keyword search returned zero and KEV had no brand match. Public discussion of a possible attack is not a demonstrated incident; None is bounded to this evidence search.
|
| Updatability
|
Very common
|
🔗 Proof
|
Active firmware release history and automatic update support are documented. Cloud connections must remain enabled for automatic delivery; USB updates are also available.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Private cloud API requests use a token; the device's local measurement/configuration API requires no dashboard token. Full mutual authentication across interfaces is therefore not present.
|
| Communications
|
No encryption
|
🔗 Proof
|
The local API uses plain HTTP. Cloud connectivity uses HTTPS, so this rating identifies the exposed local path, not every connection.
|
| Storage
|
No encryption
|
🔗 Proof
|
Official 3.7.0 code saves configuration as plain JSON in SPIFFS; its flash partition table has no encrypted flag on SPIFFS. ESP32-C3 documentation requires the encrypted flag for such data partitions. This source-based rating covers stored configuration, not cloud data; custom encrypted builds are outside scope.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
On-device local API scope: no user login or token is required. Optional cloud dashboard accounts are separate and do not protect access to the local API.
|
| Authentication
|
Absent
|
🔗 Proof
|
Local device scope: documented GET and configuration PUT examples require no credentials. The official flashing procedure also allows physical USB recovery. Cloud dashboard authentication is separate.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
For the local API there is no authentication challenge to rate-limit. This conclusion is limited to the local API and does not claim absence of cloud account protections.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Firmware emits diagnostic/configuration events, such as configuration saves and read failures, to its log stream. Local HTTP handlers do not provide a per-user authenticated access audit. Rating denotes partial diagnostic visibility, not complete security-access logging.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Provisioning hotspot uses the shared documented password 'cleanair' during its setup window. This is not the user's Wi-Fi or dashboard password; normal LAN API access does not require that password.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
AirGradient open-source embedded firmware for ESP32-C3; software version varies (Companion App: AirGradient web dashboard; local API and Home Assistant integration)
|
| Hardware (CPU / GPU)
|
CPU: ESP32-C3-MINI; single-core 32-bit RISC-V up to 160 MHz • GPU: Not applicable: ESP32-C3 microcontroller has no discrete graphics processor
|
| Memory & Storage
|
Memory: 400 KB SRAM plus 8 KB RTC SRAM; 384 KB ROM • Storage: 4 MB flash
|
| Power, Battery & Charging
|
Battery: No internal battery specified; external USB power • Power: 5 V USB, 2 A supply per official power guide; USB-C input • Charging: Not applicable; USB-C power input
|
| Display & Camera
|
Display: 1.3-inch OLED, 128 x 64 pixels; 11 RGB LEDs • Camera: None; manufacturer explicitly states no camera
|
| Sound & Connectivity
|
Sound: No microphone; no audio output specified • Connectivity: 2.4 GHz Wi-Fi 802.11 b/g/n; ESP32-C3 Bluetooth LE 5 capability listed; USB-C data/flashing. Cellular model is separate.
|
| Physical (Dimensions & Mass)
|
Dimensions: 130 x 130 x 35 mm (current product page) • Mass: 350 g (current product page)
|
Desk research dated 2026-10-23; no physical tests or cybersecurity certification. Wi-Fi model I-9PSL with official firmware, local API enabled and cloud connectivity retained. Local HTTP and unauthenticated configuration require a trusted isolated network; cloud accounts do not protect the local API. Date is Version 9 announcement/order availability (2023-10-21); shipping was scheduled for early November. Current product page gives 130 x 130 x 35 mm and 350 g; an older revision sheet differs, so hardware revision should be checked. Flash/configuration and logging ratings use 3.7.0 source. Incident categories reflect published evidence rather than measured rates; None means no qualifying incident identified, not zero risk.
Physical tampering is an assessor rating of accessible reset/reflash interfaces and the physical-access requirement; it is not an incident-frequency statistic.
Release-date scope: Founder announcement/order availability of AirGradient ONE Version 9; stated shipping in first half of November 2023, not a precise first-shipment date.
Product status: In sale. Current manufacturer page offers the I-9PSL Wi-Fi monitor.
Proposed IDRS calculation under the assessment scope above: Device 2, System 3, User Authentication 3, total 8, grade D. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.
Firmware scope: Official AirGradient ONE firmware 3.7.0 source reference, local HTTP API enabled and cloud connection retained for updates. Historical 2025 hotspot weakness is distinguished from current source behavior.
Additional references:
