| Original Prusa SL1S SPEED (SL1S)
|
|
Security Grade
Calculator v1
|
Original Prusa SL1S SPEED
Release Date: 2021-06-16 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The accessible front power button permits physical interruption of operation. Evidence boundary: A qualitative availability/resistance mapping under the website’s explicit inclusion of power interruption; no physical exploit is claimed.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
The exact 1.8.0 release documents a fix for unsafe Qt SVG path parsing, CVE-2021-45930. Evidence boundary: The historical component flaw is counted as a known disclosure, not an open flaw in the fixed baseline.
|
| Prior attacks
|
None
|
🔗 Proof
|
The reviewed model/release material does not establish an SL1S-specific field botnet or campaign. Evidence boundary: Bounded public-source finding through 24 October 2026; it is not proof that every possible attack is absent. Additional primary evidence: source 2.
|
| Updatability
|
Very common
|
🔗 Proof
|
The vendor publishes multiple successive SL1/SL1S firmware releases and documents continued updates. Evidence boundary: Repeated actual releases support the qualitative frequent-maintenance option; no owner installation or future-update guarantee is claimed. Additional primary evidence: source 2.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Local HTTP Digest checks client credentials, while the HTTP endpoint supplies no TLS-authenticated server identity. Evidence boundary: Partial covers the authenticated-client/local-HTTP boundary; no universal mutual authentication is inferred. Additional primary evidence: source 2; source 3.
|
| Communications
|
No encryption
|
🔗 Proof
|
HTTP Digest authenticates requests; it does not encrypt the local web-control payload or print-project content. Evidence boundary: The declared LAN profile has no TLS reverse proxy/VPN. Protected optional cloud connections are not claimed to be plaintext. Additional primary evidence: source 2; source 3.
|
| Storage
|
No encryption
|
🔗 Proof
|
The original key generator writes the local Digest password directly to /etc/sl1fw/api.key; init mounts /etc from a raw eMMC ext4 partition. Evidence boundary: This is a source-derived finding about a resident credential file, not just readable executable firmware. The api.key filename does not mean API-key network authentication is enabled in 1.8.0. Additional primary evidence: source 2; source 3.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The documented interface manages local login credentials; the generator supplies a single maker identity. Evidence boundary: Basic credits password management; a complete set of independent lower-privilege roles is not demonstrated by this interface. Additional primary evidence: source 2.
|
| Authentication
|
Basic
|
🔗 Proof
|
The local web interface requires a generated username/password using HTTP Digest, rather than hardware-backed user verification. Evidence boundary: A basic credential-based mechanism is credited. No MFA, resistance to every physical access path or mandatory touchscreen PIN is claimed. Additional primary evidence: source 2; source 3.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
The pinned Digest module implements per-address failure counters: default 5 failures trigger 300 seconds of evasion. Evidence boundary: The assessed configuration retains these documented module defaults. This is source review, not a lockout test; it is not a universal claim for every service or modified image. Interpretation: An implemented failed-authentication limiter meets the Exist option even though protection is per client address rather than a global account lockout. Additional primary evidence: source 2; source 3.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Prusa documents system-log export; the pinned nginx configuration disables access_log and retains critical error logging. Evidence boundary: Partial operational diagnostics are established; comprehensive access-event auditing is not claimed. Additional primary evidence: source 2.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
First use generates a random 8-character local password; custom values must be at least 8 characters. Evidence boundary: The source enforces length, not a full composition policy. Later compulsory rotation is not claimed. Interpretation: The methodology permits unique initial credentials; option 2 is the disclosed functional mapping for generated first-use credentials. Additional primary evidence: source 2; source 3.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Original Prusa SL1/SL1S firmware 1.8.0 (assessed version). (Companion App: PrusaSlicer and local PrusaLink web interface; optional Prusa Connect is not enabled in this assessment.)
|
| Hardware (CPU / GPU)
|
CPU: A64 mainboard; CPU details not publicly disclosed in cited manufacturer specifications. • GPU: Not publicly disclosed in cited manufacturer documentation.
|
| Memory & Storage
|
Memory: Not publicly disclosed in cited manufacturer documentation. • Storage: Internal project storage; capacity not publicly disclosed in cited manufacturer documentation. USB drive import supported.
|
| Power, Battery & Charging
|
Battery: Not applicable for printing operation: external-PSU/mains-powered printer. • Power: External PSU; approximately 100 W (+/-5 W) while printing. • Charging: Not applicable: no battery-charging workflow for normal printing.
|
| Display & Camera
|
Display: Capacitive control touchscreen; separate 5.96-inch 2560 x 1620 monochrome exposure LCD. • Camera: Not publicly disclosed in cited manufacturer documentation (no built-in camera specification).
|
| Sound & Connectivity
|
Sound: Audible self-test music; audio hardware specifications not publicly disclosed. • Connectivity: USB, Wi-Fi and Ethernet LAN; service microUSB port.
|
| Physical (Dimensions & Mass)
|
Dimensions: 225 x 237 x 400 mm (X x Y x Z; printer, not shipping box). • Mass: 10.6 kg net assembled-printer weight (14.7 kg gross).
|
Assessment scope
Documentation/source-based deployment assessment of SL1S SPEED with official firmware 1.8.0. Local PrusaLink HTTP Digest is enabled with a generated unique password and the documented authentication-module default policy (5 failures per client address, 300-second evasion). These limits are declared baseline settings, not a measured installation result. Cloud registration, optional SSH access, a VPN and a TLS reverse proxy are not enabled. The local network-control and internal credential-storage paths are in scope; the printer is not physically tested.
Method and evidence boundaries
This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.
Calculated IDRS: 2 + 3 + 2 = 7 (C).
Date basis: Josef Prusa’s official 16 June 2021 product announcement. The same article separately schedules shipping for late June/early July; this field records the announcement date, not an invented first-shipment day.
Date source: https://blog.prusa3d.com/introducing-sl1s_fastest_desktop_sla_3d_printer_51436/
Patch/support context: Firmware 1.8.0 removed the older API-key authentication mode and retained HTTP Digest. The general help article still describes that older option, so the pinned release notes take precedence for this baseline. The credential file continues to be named api.key in the source; its plaintext storage is not confused with the removed network mode. No 2026 physical retest is claimed.
Product-specific boundaries: Hardware/model are SL1S SPEED; the cited firmware repository and release explicitly support both SL1 and SL1S. Documented default module thresholds are explicit deployment conditions; they were not measured on the student’s printer. The stored-password conclusion comes from exact-version generator and eMMC-mount source, not from assuming every ext4 file is necessarily unencrypted. Optional SSH/cloud/VPN/proxy services are outside this declared local deployment; the grade is not a manufacturer certificate. No exact-model field campaign was established in the reviewed sources; frequency categories remain qualitative judgments.
Hardware and general-information supplement
Supplement reviewed on 25 October 2026. Manufacturer model specifications and explicitly identified historical manuals support the added fields. Hardware capabilities do not imply that optional services, accessories or every capacity variant are enabled in the assessed case. Unpublished or unverified parameters are identified rather than guessed. Current sale/support status is separate from the original historical firmware/configuration assessment; the twelve security selections and original evidence have not been changed.
Specification evidence
Specification qualifications
- The 5.96-inch exposure LCD is separate from the front control touchscreen.
- Net and gross weight are taken from the original SL1S SPEED manufacturer handbook; its university-hosted copy is identified as a mirror.
- Unpublished RAM and flash-capacity figures are not inferred from related printer models.
