| Dragino SN50v3-LB
|
|
Security Grade
Calculator v1
|
Dragino SN50v3-LB LoRaWAN Sensor Node
Release Date: 2023-09-26 • Status: In sale
Classification Date: 2026-10-25 • [Dragino Technology Co., Limited Official Website]
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The device exposes UART and sensor I/O interfaces. Physical access could allow configuration changes or firmware replacement, but no confirmed tampering incident was identified.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No model-specific published vulnerability was established during this review. The availability of open-source firmware does not guarantee the absence of vulnerabilities.
|
| Prior attacks
|
None
|
🔗 Proof
|
No publicly confirmed attack specifically targeting the SN50v3-LB was established in the reviewed sources.
|
| Updatability
|
Very common
|
🔗 Proof
|
The manufacturer supports wireless OTA firmware updates and UART-based firmware upgrades. Public firmware releases and source code are also available.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
The sensor uses LoRaWAN OTAA activation with device-specific keys to join a compatible LoRaWAN network server.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The device supports LoRaWAN 1.0.3, which specifies AES-128-based network and application communication security when properly configured.
|
| Storage
|
No encryption
|
🔗 Proof
|
The device retains firmware, settings and network credentials in embedded memory. Encryption at rest was not established in the reviewed documentation; this selection is provisional.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
No local multi-user account system is documented. User account administration is normally performed by the external LoRaWAN network server.
|
| Authentication
|
Basic
|
🔗 Proof
|
The device uses LoRaWAN OTAA keys and a password-protected local AT-command configuration interface. These are not equivalent to a full multi-user login system.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
No failed-attempt lockout or rate-limiting mechanism for local AT-command authentication was established in the reviewed documentation.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The device reports sensor readings and status messages, but comprehensive user-access security audit logging is not established.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The local UART AT-command password is derived from the last six characters of the AppSKey or the device PIN. This is a documented credential derivation method, but its practical guessability has not been independently tested.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded open-source firmware (Companion App: LoRaWAN Network Server / BLE configuration tool)
|
| Hardware (CPU / GPU)
|
CPU: LA66 LoRaWAN module (ASR6601-based) • GPU: None
|
| Memory & Storage
|
Memory: Not publicly verified • Storage: Embedded flash memory; capacity not verified
|
| Power, Battery & Charging
|
Battery: 8500mAh Li-SOCl2 battery pack (ER26500 + SPC1520) • Power: Battery powered • Charging: Non-rechargeable
|
| Display & Camera
|
Display: Status LEDs • Camera: None
|
| Sound & Connectivity
|
Sound: None specified • Connectivity: LoRaWAN 1.0.3 Class A, Bluetooth 5.1, UART, GPIO, ADC, I2C
|
| Physical (Dimensions & Mass)
|
Dimensions: Not publicly verified • Mass: Not publicly verified
|
The Dragino SN50v3-LB is a third-generation multi-purpose LoRaWAN sensor node designed for industrial monitoring, smart agriculture and IoT prototyping. It supports multiple external sensor interfaces, Bluetooth 5.1 configuration and LoRaWAN 1.0.3 Class A communication.
The device supports LoRaWAN OTAA activation with device-specific credentials, wireless OTA firmware updates and UART-based firmware upgrades. Dragino also provides publicly available firmware source code.
An important security consideration is its local AT-command authentication mechanism. Manufacturer documentation states that the UART password is derived from the last six characters of the AppSKey or device PIN. Physical access to the UART interface could therefore create an additional attack surface.
LoRaWAN communication uses AES-128-based security when correctly configured. However, the available documentation does not fully establish encryption of locally stored credentials, failed-login lockout policies or comprehensive security audit logging.
Some ratings are provisional because the available evidence does not establish every device-level security property.
Sources:
https://wiki.dragino.com/docs/LoRaWAN-End-Node/io-controllers-sensor-nodes/sn50v3-lbsn50v3-ls/
https://wiki.dragino.com/docs/LoRaWAN-Firmware-Update/uart-ttl-upgrade-mode/
https://github.com/dragino/SN50v3
