Aqara Smart Lock U100 (SDL-D01)

Security Grade

A-

Calculator v1

Aqara Smart Lock U100

   Brand: Aqara (Parent: Lumi United Technology Co., Ltd.)

   Category: Smart Lock • Model / Gen: 1st generation (Aqara's first deadbolt smart lock) SDL-D01 (lock); DL-D01D (Kit)

   Release Date: 2023-06-01 • Status: In sale

   Classification Date: 2026-10-25 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	https://www.aqara.com/us/support/smart-lock-u100 🔗 Proof	No public hardware-bypass or teardown attack found; NVD query for SDL-D01 returns 0 CVEs. Aqara claims EMC/Tesla-coil resistance; mechanical key is an intended emergency path.
Known vulnerabilities	Rare	https://nvd.nist.gov/vuln/detail/cve-2026-50083 https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=SDL-D01&resultsPerPage=20 🔗 Proof	2026 Aqara cloud IAM flaws allowed unauthenticated lock operation; vendor fixed them by 2026-04. No U100/SDL-D01-specific CVE was found, so Rare rather than Very common.
Prior attacks	None	https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Aqara&resultsPerPage=50 🔗 Proof	RunZero timeline shows the 2026 cloud issues were researcher PoCs, patched within 90 days. No public in-the-wild exploitation or attack on U100 was found.
Updatability	Very common	https://forum.aqara.com/t/u100-firmware-update/146601/4 🔗 Proof	Firmware updates run through Aqara Home over Bluetooth, no hub needed. Forum confirms 3.0.0.0031 phased rollout in Dec 2025; vendor publishes no support end date.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	https://www.aqara.com/en/product/smart-lock-u100 🔗 Proof	Apple HomeKit certified and Matter-capable with a compatible hub; pairs with Apple Home, Google Home and Alexa using their authentication.
Communications	Encrypted with up-to-date encryption	https://www.aqara.com/en/uncategorized/aqara-introduces-its-first-deadbolt-smart-lock-u100/ 🔗 Proof	Vendor states end-to-end 128-bit AES; Zigbee 3.0 uses AES-128-CCM. Cloud TLS details and BLE pairing encryption strength are not published.
Storage	Encrypted with up-to-date encryption	https://www.aqara.com/en/product/smart-lock-u100 🔗 Proof	Fingerprints and passcodes are stored locally with AES encryption per vendor. Key management and secure-element details are not published, so some uncertainty remains.
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Full	https://www.aqara.com/en/uncategorized/aqara-introduces-its-first-deadbolt-smart-lock-u100/ 🔗 Proof	First setup creates an admin; up to 50 accounts with admin/ordinary roles and permission levels. No public documentation of 2FA for Aqara Home.
Authentication	Secure	https://www.aqara.com/en/product/smart-lock-u100 🔗 Proof	Nine unlock methods including fingerprint (50 prints), 6-10 digit PIN, NFC and Apple Home Key. Biometrics are strong; a numeric PIN alone is weaker.
Brute-force protection	Absent	🔗 Proof	Official FAQ states the keypad will NOT lock after repeated password/fingerprint/NFC failures by default; lockout is promised in a future OTA. No rate limit now.
Event logging	Partial logging	https://www.aqara.com/us/support/smart-lock-u100 🔗 Proof	With a hub the app shows real-time activity/device logs, but the product page says door-status logging is still pending and FAQ lists only lock/unlock/failure states.
Passwords	Require change after setup	🔗 Proof	No factory default; first binding requires an admin-set 6-10 digit PIN with anti-peep entry. Only length is enforced; no complexity or rotation rule.
Category Score	Score: 2 / 3

Property	Details
Operating System & App	N/A (embedded firmware; no public OS name) (Companion App: Aqara Home (iOS/Android); Apple Home; Google Home; Alexa)
Hardware (CPU / GPU)	CPU: N/A • GPU: N/A
Memory & Storage	Memory: N/A • Storage: N/A (local secure memory holds up to 50 fingerprints and 75 passcodes; capacity not published)
Power, Battery & Charging	Battery: 4 x AA (1.5 V) batteries, 6 V; up to 8 months • Power: 6 V DC from 4 AA batteries • Charging: USB-C 5 V emergency power input only (AA batteries not rechargeable)
Display & Camera	Display: N/A (keypad with LED indicators, no display) • Camera: N/A
Sound & Connectivity	Sound: Built-in speaker for voice prompts • Connectivity: Zigbee 3.0; Bluetooth 5.0; NFC (Apple Home Key and NFC cards)
Physical (Dimensions & Mass)	Dimensions: Outer panel 134.2 x 73.2 x 81.4 mm; inner panel 140.2 x 76.2 x 29 mm • Mass: 1.76 kg (3.87 lb, vendor item weight)

Student assignment submission for IoT security assessment.