Samsung SmartThings Hub V3 (STH-ETH-250)
From Wiki-IoT
| Samsung SmartThings Hub V3 (STH-ETH-250) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Samsung SmartThings Hub V3 (STH-ETH-250)
Brand: Samsung (Parent: Samsung Electronics) Category: Smart Home Hub • Model / Gen: 3rd STH-ETH-250 Release Date: 2018-08-13 • Status: In sale Classification Date: 2026-10-28 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Wall/plug-mounted hub; physical access not primary threa |
| Known vulnerabilities | Very common | 🔗 Proof | Cisco Talos disclosed 20 vulnerabilities in 2018: CVE-2018-3856 through CVE-2018-3917, including unauthenticated RCE, SQLi, command injection, buffer overflows |
| Prior attacks | Rare | 🔗 Proof | Demonstrated exploit chain could take over locks/cameras; not major botnet node |
| Updatability | Rare | 🔗 Proof | Patches issued in 2018; V3 now legacy, superseded by newer Hub |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | hubCore listens on port 39500 and relays unauthenticated messages to remote servers |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Crash minidumps sent over insecure HTTPS to backtrace.io; modern firmware uses TLS |
| Storage | Encrypted with up-to-date encryption | 🔗 Proof | Sensitive data in minidumps exposed; patched in later firmware |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Samsung account required; role-based sharing limited |
| Authentication | Basic | 🔗 Proof | Local HTTP server accepted unauthenticated JSON |
| Brute-force protection | Basic | 🔗 Proof | Account-level protections only |
| Event logging | Partial logging | 🔗 Proof | Hub logs basic events; not full access audit |
| Passwords | Require change after setup | 🔗 Proof | Default hub password changed during setup |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded Linux (Ubuntu Core) (Companion App: SmartThings) |
| Hardware (CPU / GPU) | CPU: Samsung Exynos • GPU: |
| Memory & Storage | Memory: 1 GB RAM • Storage: 8 GB eMMC |
| Power, Battery & Charging | Battery: No battery • Power: 5V DC power adapter • Charging: N/A |
| Display & Camera | Display: No display • Camera: No camera |
| Sound & Connectivity | Sound: No speaker • Connectivity: Wi-Fi, Zigbee, Z-Wave, Bluetooth, Ethernet |
| Physical (Dimensions & Mass) | Dimensions: 4.9 x 3.0 x 1.0 inches • Mass: 0.5 lbs (227 g) |
