| De'Longhi PrimaDonna Soul (ECAM610.75.GB)
|
|
Security Grade
Calculator v1
|
De'Longhi PrimaDonna Soul
Release Date: 2021-09-10 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
—
|
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
|
| Prior attacks
|
Rare
|
🔗 Proof
|
|
| Updatability
|
None
|
—
|
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
—
|
|
| Communications
|
Encrypted with obselete encryption
|
—
|
|
| Storage
|
No encryption
|
—
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
—
|
|
| Authentication
|
Basic
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
—
|
|
| Event logging
|
Partial logging
|
—
|
|
| Passwords
|
Default/Common/Easy to guess
|
—
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
De'Longhi IoT OS (Linux based) (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: ARM Cortex-A5 • GPU: None
|
| Memory & Storage
|
Memory: 256 MB RAM • Storage: 2 GB eMMC
|
| Power, Battery & Charging
|
Battery: None • Power: 220V AC, 1450W • Charging:
|
| Display & Camera
|
Display: 3.5 inch TFT touchscreen • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: 2.4GHz Wi-Fi, Bluetooth
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
CVE-2022-46640 is an OS command injection vulnerability in the De'Longhi PrimaDonna connected coffee machines (CVSS 9.8, Critical). An attacker on the local network can send a crafted request to the machine's web server and execute arbitrary operating system commands with root privileges. Because the device has no firmware update mechanism, the flaw cannot be patched by the user. A compromised coffee machine can be used as a low-power, always-on device inside the home LAN, which makes it a convenient pivot point for further attacks.
