| Dragino WSC1-LB
|
|
Security Grade
Calculator v1
|
Dragino WSC1-L LoRaWAN Weather Station Controller
Release Date: 2022-06-24 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The controller provides physical access to internal jumpers, RS485 wiring and a firmware programming port. Physical tampering is possible, but no model-specific incident is established.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No WSC1-L-specific published vulnerability was established in the reviewed manufacturer documentation. This does not demonstrate that the device is vulnerability-free.
|
| Prior attacks
|
None
|
🔗 Proof
|
No confirmed attack specifically targeting the WSC1-L was established in the reviewed documentation.
|
| Updatability
|
Very common
|
🔗 Proof
|
The manufacturer documents firmware upgrades through a programming port and provides firmware upgrade instructions and version information.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Each controller is supplied with unique LoRaWAN OTAA keys for activation through a compatible network server.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The controller uses LoRaWAN 1.0.3, which specifies AES-128-based wireless communication security. The security of the separate RS485 connection is not established.
|
| Storage
|
No encryption
|
🔗 Proof
|
The controller stores device configuration and network credentials, but encryption at rest has not been established in the reviewed documentation. This selection is provisional.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
No local multi-user account management interface is documented. Network-server account management depends on the external platform.
|
| Authentication
|
Basic
|
🔗 Proof
|
The controller uses LoRaWAN OTAA credentials and supports local AT-command configuration. A separate secure local user-login system has not been established.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
No device-level login rate limiting or failed-attempt lockout policy is documented. External network-server protections are outside this device-level assessment.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The controller reports device status and sensor measurements periodically, but comprehensive user-access security audit logging has not been established.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The reviewed WSC1-L documentation does not establish the initial local configuration password policy. This forced-choice selection is not evidence of weak default credentials.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Companion App: LoRaWAN Network Server)
|
| Hardware (CPU / GPU)
|
CPU: Not publicly specified • GPU: None specified
|
| Memory & Storage
|
Memory: Not publicly specified • Storage: Embedded configuration memory
|
| Power, Battery & Charging
|
Battery: 1000mAh rechargeable Li-ion backup battery • Power: External 12V DC, solar power system compatible • Charging: Rechargeable from external power
|
| Display & Camera
|
Display: None specified • Camera: None
|
| Sound & Connectivity
|
Sound: None specified • Connectivity: LoRaWAN 1.0.3, RS485 / Modbus
|
| Physical (Dimensions & Mass)
|
Dimensions: Not publicly specified • Mass: Not publicly specified
|
The Dragino WSC1-L is an industrial LoRaWAN weather station controller designed for outdoor environmental monitoring. It connects to multiple sensors through RS485/Modbus, including wind speed, rainfall, temperature, humidity, air pressure and solar radiation sensors.
The controller supports LoRaWAN 1.0.3, unique OTAA activation credentials, remote configuration through LoRaWAN downlink commands and firmware upgrades through a programming port.
LoRaWAN communication provides AES-128-based security when correctly configured. However, this does not establish encryption or authentication on the separate RS485/Modbus sensor interface.
Potential security concerns include physical access to the programming interface and limited public information about stored credential encryption, local password policies, brute-force protection and security audit logging.
Several security ratings are provisional because the manufacturer documentation does not establish every security control. These ratings should not be interpreted as independently confirmed vulnerabilities.
Sources:
https://wiki.dragino.com/docs/LoRaWAN-End-Node/weather-stations/wsc1-l/
https://www.dragino.com/downloads/index.php?dir=LoRa_End_Node%2FWeather_Station%2F
