| Meross Smart Plug Mini (MSS110)
|
|
Security Grade
Calculator v1
|
Meross Smart Wi-Fi Plug Mini
Category: Smart plug (Wi-Fi) • Model / Gen: MSS110 (US/CA, EU, UK variants); MSS110HK (HomeKit)
Release Date: 2017-03-27 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
—
|
No hardware tampering reports found in my search.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Two CVEs, both from 2018 on firmware up to 1.1.24: blank-password Telnet admin (CVE-2018-6401) and unauthenticated admin page (CVE-2018-10544).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Public exploit reference exists (Exploit-DB), but no confirmation of active exploitation was found.
|
| Updatability
|
Rare
|
🔗 Proof
|
Meross releases firmware updates (e.g. HomeKit stability notice), but no published security-update policy was found.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Third-party protocol analysis: device uses an MQTT broker over TLS, but the pairing step sends account keys to the plug over local HTTP (may have changed in newer firmware)
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Vendor states data is securely transmitted to AWS servers; Wi-Fi security supports WPA2-PSK (and legacy WEP), WPA3 not listed.
|
| Storage
|
No encryption
|
—
|
No public documentation of storage encryption found; vendor states data is stored on AWS servers
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
through a Meross account and app. 🔗 Proof
|
Managed through a Meross account and app
|
| Authentication
|
Secure
|
🔗 Proof
|
Meross supports two-factor
|
| Brute-force protection
|
Basic
|
—
|
No public documentation found
|
| Event logging
|
Partial logging
|
—
|
No public documentation of an access log found
|
| Passwords
|
Require change after setup
|
—
|
Current setup uses the user's own Meross account; 2018 firmware had a blank-password Telnet admin (CVE-2018-6401), fixed later
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Not disclosed (Companion App: Meross (also Apple Home for HomeKit version))
|
| Hardware (CPU / GPU)
|
CPU: Not disclosed • GPU: Not disclosed
|
| Memory & Storage
|
Memory: Not disclosed • Storage: Not disclosed
|
| Power, Battery & Charging
|
Battery: None • Power: 110–125 V, 15 A (1800 W max) • Charging: N/A
|
| Display & Camera
|
Display: None (status LED, on/off button) • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: WEP 64/128-bit, WPA/WPA2-PSK
|
| Physical (Dimensions & Mass)
|
Dimensions: 3 × 2.5 × 1.5 in • Mass: Not disclosed
|
The Meross Smart Plug Mini (MSS110) is a Wi-Fi smart plug controlled through the Meross cloud. Its two known CVEs date from 2018 and affected firmware up to 1.1.24 (blank-password Telnet admin, unauthenticated admin page). Positives are optional two-factor authentication and TLS cloud communication. Weaknesses are limited public documentation on security updates and storage encryption, and legacy WEP support.
