Loxone Miniserver Gen 1

Security Grade

Calculator v1

   Brand: Loxone (Parent: Loxone Electronics GmbH)

   Category: Building automation controller • Model / Gen: Miniserver Gen 1 (Part No. 100001) Miniserver Gen 1

   Release Date: 2010-06-01 • Status:

   Classification Date: 2026-10-26 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	DIN-rail unit with no external debug ports. Physical and console access are possible but not a normal attack path.
Known vulnerabilities	Very common	[1] [2] 🔗 Proof	Cloud DNS registration is unauthenticated, CVE-2020-27488. Older firmware also has cleartext data, XSS, XSRF, response splitting and DoS issues.
Prior attacks	Rare	🔗 Proof	Demonstrated by university researchers; no widespread campaign reported.
Updatability	Rare	🔗 Proof	Loxone still supports the platform, but Gen 1 is legacy and the current product is Gen 2, so update frequency for Gen 1 is limited.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Cloud DNS accepts unauthenticated IP announcements, enabling redirection and credential phishing.
Communications	No encryption	🔗 Proof	The datasheet specifies HTTP only, so management traffic is cleartext.
Storage	Encrypted with obselete encryption	🔗 Proof	Credentials are stored encrypted, but the decryption key could be requested without authentication.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	User accounts and permissions exist, but no fine-grained role model for Gen 1 is documented.
Authentication	Basic	🔗 Proof	Password login exists, but Cloud DNS redirection can capture credentials and there is no mandatory 2FA.
Brute-force protection	Basic	🔗 Proof	Standard login, but no published failed-login lockout threshold.
Event logging	Partial logging	🔗 Proof	System and event logs exist, but no complete administrator-access audit trail is documented.
Passwords	Require change after setup	🔗 Proof	User sets the admin password during commissioning and no factory default admin password is documented.
Category Score	Score: 2 / 3

Property	Details
Operating System & App	Loxone OS (Linux-based) (Companion App: Loxone App)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: 18-30 V DC, typ. 2.1 W • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Ethernet, Loxone Link, KNX
Physical (Dimensions & Mass)	Dimensions: 157 x 88 x 57 mm • Mass: 327 g