Netatmo Smart Thermostat (NTH01)
From Wiki-IoT
| Netatmo Smart Thermostat (NTH01) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Netatmo Smart Thermostat
Brand: Netatmo (Parent: Netatmo (Legrand Group)) Category: Smart thermostat • Model / Gen: Smart Thermostat NTH01 Release Date: 2021-01-12 • Status: In sale Classification Date: 2026-10-27 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | 🔗 Proof | Wall mounted or table top thermostat with no exposed service connector and no public teardown reporting an accessible debug interface. |
| Known vulnerabilities | None | 🔗 Proof | No CVE entry matching Netatmo was found in the NVD at the time of classification. |
| Prior attacks | None | 🔗 Proof | No public report of botnet recruitment or exploitation of Netatmo thermostats was found. |
| Updatability | Very common | 🔗 Proof | Netatmo delivers firmware updates over the air through the app and keeps the cloud API versioned. |
| Category Score | Score: 1 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Integration with third party systems runs through the Netatmo Connect API using OAuth 2.0, but the radio link between thermostat and receiver is not documented as cryptographically authenticated. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Cloud and app communication use HTTPS with TLS, and the vendor documents encryption of exchanges with its servers. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Measurement history is stored in the vendor cloud in the European Union under a GDPR privacy policy, but no encryption at rest is documented for data held on the device itself. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Netatmo account with home member sharing and limited role granularity. |
| Authentication | Basic | 🔗 Proof | E-mail and password login with OAuth based third party access; no mandatory second factor is documented. |
| Brute-force protection | Basic | 🔗 Proof | No published documentation of failed-attempt lockout for the cloud account. |
| Event logging | Partial logging | 🔗 Proof | Temperature and schedule history are available; no full security audit log is documented. |
| Passwords | Require change after setup | 🔗 Proof | The account is created during setup; no enforced complexity policy is published. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (Companion App: Netatmo app / Home + Control app (iOS / Android)) |
| Hardware (CPU / GPU) | CPU: N/A • GPU: N/A |
| Memory & Storage | Memory: N/A • Storage: N/A |
| Power, Battery & Charging | Battery: Backup battery in the thermostat module • Power: Mains powered receiver or boiler module • Charging: N/A |
| Display & Camera | Display: E-ink display with control dial • Camera: None |
| Sound & Connectivity | Sound: None • Connectivity: Wi-Fi 802.11 b/g/n, Bluetooth LE, radio link to the receiver |
| Physical (Dimensions & Mass) | Dimensions: approx. 80 x 80 x 22 mm • Mass: approx. 180 g |
Data sources: official Netatmo documentation (netatmo.com, dev.netatmo.com) and the NVD vulnerability database (nvd.nist.gov). Ratings follow the IDRS v1 (North American academic) grade calculator; the grade is computed automatically from the CRIS scores entered above.
