| Nanoleaf Essentials Smart Bulb (NL55)
|
|
Security Grade
Calculator v1
|
Nanoleaf Essentials Smart Bulb
Category: Smart bulb • Model / Gen: Essentials NL55
Release Date: 2021-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
Bulb form factor with no exposed service connector; no teardown report of an accessible debug interface.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No CVE entry matching Nanoleaf was found in the NVD at the time of classification.
|
| Prior attacks
|
None
|
🔗 Proof
|
No public report of botnet recruitment or exploitation of Nanoleaf products.
|
| Updatability
|
Very common
|
🔗 Proof
|
Matter and Thread devices receive over-the-air firmware updates pushed through the Nanoleaf app.
|
| Category Score
|
Score: 1 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Matter mandates certificate-based device attestation with PKI, so device identity is cryptographically verified at commissioning.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Thread network layers use AES-128-CCM with rotating network keys.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Matter requires secure storage of device credentials and network keys.
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Nanoleaf account combined with the Matter multi-admin model for controlled sharing.
|
| Authentication
|
Secure
|
🔗 Proof
|
Commissioning requires certificate attestation plus a one-time setup code; no default password exists.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
The setup code is single-use and the commissioning window is time limited.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The companion app exposes limited activity information and no full security audit log.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
No device-local default password; access depends on the cloud account complexity policy.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: Nanoleaf App)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: E27 base, 110-240 V AC, 9 W • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Thread, Bluetooth LE, Matter over Thread
|
| Physical (Dimensions & Mass)
|
Dimensions: 62 x 62 x 110 mm • Mass: approx. 90 g
|
Overall assessment: This is the strongest device in the batch. No Nanoleaf CVE was found in the NVD and no public exploitation report exists. Security properties come from the Matter and Thread standards rather than vendor-specific design: certificate-based device attestation with PKI at commissioning, AES-128-CCM with rotating network keys for transport, and mandated secure storage for credentials and network keys. Brute-force exposure is limited because the setup code is single-use and the commissioning window is time limited. The only non-optimal criterion is event logging, where the app offers limited activity history and no full security audit log. Note that the hardware criteria are judged as "None" for absence of published evidence rather than proven impossibility.
