Coolpad 40 Pro

Classification

Device
Criterion	Value	Proof(s)	Comment
Known hardware tampering	None	[2]	As a non-standard/no-name device, hardware-level tampering (e.g., pre-installed malware, compromised components) is extremely common and a significant risk
Known vulnerabilities	None	[3]	Runs heavily modified, outdated Android versions with numerous unpatched known vulnerabilities. No security updates are provided.
Prior attacks	Very common	[4]	Such devices are common vectors for adware, spyware, and data theft. They are frequently involved in broader security incidents targeting low-security devices
Updatability	None	[5]	There is no official support, update mechanism, or security patches provided for this device.
Category score	2

System
Criterion	Value	Proof(s)	Comment
Authentication with other systems	Full	[6]	The software stack is untrustworthy. Even if it supports basic screen locks, the underlying system integrity cannot be verified for secure authentication with other services.
Communications	No encryption	[7]	Communications (e.g., network traffic) may be intercepted or misrouted by malicious pre-installed software. End-to-end encryption cannot be guaranteed.
Storage	Encrypted with up-to-date encryption	[8]	t is highly unlikely that this device uses any form of reliable storage encryption. User data is stored in plain text and is easily accessible.
Category score	2

User Authentication
Criterion	Value	Proof(s)	Comment
Account management	Basic	[9]	Supports basic Lacks proper, secure account management features. Any account integration is risky as credentials could be stolen.lock methods (pattern, PIN, password). Unlikely to have a Trusted Execution Environment (TEE) for enhanced security.
Authentication	Basic	[10]	Cannot be considered secure. The authentication process itself may be compromised by the device's software
Brute-force protection	Basic	[11]	Cannot be considered secure. The authentication process itself may be compromised by the device's software
Event logging	Partial logging	[12]	No reliable or accessible security event logging exists. Malicious activity on the device would not be recorded.
Passwords	Default/Common/Easy to guess	[13]	There are no enforced password policies. Default passwords are common and user-set passwords are not protected.
Category score	3

Grade	C