| Emerson Sensi Touch 2 (ST76)
|
|
Security Grade
Calculator v1
|
Sensi Touch 2 smart thermostat (model ST76 / ST76W, 1F96U-42WF series)
Category: Smart thermostat • Model / Gen: Touch 2 ST76 (black), ST76W (white); 1F96U-42WF series
Release Date: 2022-06-28 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
No public teardown or tampering CVE specific to ST76 is on record; the device is wall-mounted behind a standard wallplate and relies on HVAC low-voltage wiring. Physical attack surface is bounded.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No CVE has been published against Sensi ST76 / 1F96U series or any Sensi Wi-Fi thermostat in NVD as of 2026-10-24; the only Emerson CVEs in NVD (e.g. CVE-2025-48496) concern ValveLink industrial software, not Sensi thermostats.
|
| Prior attacks
|
None
|
🔗 Proof
|
No public security report attributes an in-the-wild attack, botnet inclusion or mass compromise to Sensi thermostats; there is no documented prior attack history at the model or product-line level.
|
| Updatability
|
Rare
|
🔗 Proof
|
Sensi states it follows Emerson's vulnerability remediation policy and pushes occasional firmware updates, but does not advertise a continuous automatic-update cadence or a guaranteed support window; firmware updates are infrequent and user-initiated via app when offered. Rated Rare.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The thermostat is bound to a Sensi cloud account and works with Amazon Alexa, Google Assistant and Samsung SmartThings through the Sensi cloud; these third-party integrations are authenticated via OAuth/cloud linkage rather than per-device mutual cryptographic auth on the local LAN. The assessed profile does not enable direct HomeKit on ST76 (Touch 2 does not advertise HomeKit), so Partial.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The Sensi Networking and Security Guide states Sensi uses TLS for cloud traffic and follows Emerson's information security policy; the assessed profile uses the default Sensi-app-to-cloud TLS channel. No public documentation identifies WEP/TLS 1.0-era weak crypto as the live transport, so the rating is Encrypted with up-to-date encryption.
|
| Storage
|
No encryption
|
🔗 Proof
|
Sensi markets privacy protection (no sale of personal data) but does not publish a per-partition flash encryption claim for the thermostat's internal storage (e.g. Wi-Fi credentials, schedule, account tokens). Per WikiIoT rule, an undocumented local-flash encryption state is rated No encryption.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The Sensi app supports a single owner account, shared access by email invite, multi-thermostat management and removal, but does not advertise role-based granular permissions, device-access auditing, or per-user on-device PIN profiles. Rated Basic rather than Full.
|
| Authentication
|
Basic
|
🔗 Proof
|
Access to the thermostat is via Sensi account sign-in in the Sensi app; the assessed profile does not enable optional 2FA on the Sensi/Emerson account, so cloud authentication is rated Basic rather than Secure.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
The thermostat supports Total/Partial Keypad Lockout on the physical screen, but cloud-side account throttling is the only protection against online password guessing; the assessed profile does not enable optional 2FA. The combination of local keypad lockout plus account throttling is rated Basic.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
The Sensi app records usage reports and smart alerts (high/low temperature, loss of heat/cool, filter reminders) with timestamps, providing a reviewable event history in the app.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Each unit ships with a unique per-device Sensi Security Code printed on the thermostat label, used once during BLE/Wi-Fi provisioning in the app; after setup, day-to-day access is via the user's own Sensi account password. There is no universal hard-coded default password, and the device does not enforce a separate on-device PIN complexity policy. Rated Require change after setup.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded Sensi firmware; assessment: current firmware as of 2026-10-24 (Companion App: Sensi app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: Hardwired 20–30 VAC, 50/60 Hz (common wire / C-wire required); 1.5 A max per terminal • Charging:
|
| Display & Camera
|
Display: 4.3 in full-color glass LCD touchscreen, continuous backlight with C-wire • Camera:
|
| Sound & Connectivity
|
Sound: Key-press beeper (keypad lockout supported) • Connectivity: 2.4 GHz Wi-Fi 802.11 b/g/n; Bluetooth Low Energy (for setup); optional Sensi room sensor (sub-1 GHz, ~100 ft)
|
| Physical (Dimensions & Mass)
|
Dimensions: 5.6 W x 3.25 H x 0.77 D in (142 x 83 x 19.6 mm) • Mass:
|
Documentation-based security assessment: Sensi Touch 2 smart thermostat (ST76 / ST76W, 1F96U-42WF series). Reviewed 2026-10-24.
Documentation-based assessment of a defined Sensi profile. The thermostat is set up through the Sensi app on iOS/Android and bound to a single Sensi cloud account; the account uses a self-chosen password but optional 2FA is not enabled in this profile. The default Sensi-app-to-cloud TLS channel is used; BLE is used only during initial pairing. Third-party integrations with Amazon Alexa, Google Assistant and Samsung SmartThings are linked through the Sensi cloud via OAuth rather than local per-device mutual authentication; HomeKit is not enabled on ST76. Power is hardwired 24 VAC via a C-wire. Firmware updates are offered infrequently through the Emerson vulnerability-remediation process and applied from the app when available. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.
Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform-level history; no Sensi thermostat CVE or in-the-wild attack record is on file. Optional capabilities (e.g. 2FA, HomeKit, local per-device auth) are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected current firmware remains vulnerable.
Release-date scope: 2022-06-28, the date ST76W is registered as "Sensi Touch 2" in the PSE qualified products list; the retail spec sheet and user manual are dated 2022. Not asserted to be the earliest worldwide retail date.
Historical vulnerability: none on record. NVD contains no CVE against Sensi ST76 / 1F96U series or any Sensi Wi-Fi thermostat; the only Emerson CVE in NVD in this window (CVE-2025-48496) concerns Emerson ValveLink industrial software, not Sensi thermostats.
No physical device was tested. Keep the configuration and evidence scope with the ratings.
References:
Sensi — Touch 2 retail spec sheet (R-5530, ©2022)
Sensi — Which Sensi thermostat do I have? (ST76 = Touch 2)
Sensi Touch 2 user manual (R-5580, June 2022)
PSE qualified products list — ST76W Sensi Touch 2 certified 2022-06-28
Emerson — Sensi Thermostat Networking and Security Guide
Sensi — Where to find your Security Code / PIN
NVD search — "sensi thermostat" (no thermostat CVE)
NVD — CVE-2025-48496 (Emerson ValveLink, not Sensi)
WikiIoT methodology
