| Sonoff Basic R3 (BASICR3)
|
|
Security Grade
Calculator v1
|
Sonoff Basic R3
Release Date: 2019-06-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Very common
|
🔗 Proof
|
Security research on Sonoff hardware reports an open UART / download mode (CWE-1191) and no Secure Boot (CWE-1326), allowing firmware extraction and rewriting.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
CVE-2020-12702 discloses Wi-Fi credentials during ESP-Touch quick pairing; Bitdefender documented a cloud-side takeover of any device; CVE-2024-7205 allows a secondary user to seize a shared device.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Bitdefender confirmed and demonstrated a remote hijack path; no evidence of mass in-the-wild exploitation.
|
| Updatability
|
Very common
|
🔗 Proof
|
The eWeLink app queries the server for updates and pushes them to the device OTA.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Device-to-cloud binding relies on a 5-byte device ID with only 3 random bytes, not cryptographically bound to a device-held secret.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
The ESP-Touch / Smart Config pairing protocol is insecure by design and leaks Wi-Fi credentials (CVE-2020-12702).
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No Secure Boot and no documented encryption at rest for stored credentials.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The server validates only the bearer token and does not verify device ownership, so shared devices can be reassigned.
|
| Authentication
|
Basic
|
🔗 Proof
|
Device keys leak through multiple channels: insecure mobile logs, Bluetooth pairing data, and the secondary-user homepage endpoint.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
The short random portion of the device ID makes enumeration practical, and no failed-attempt throttling is documented.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Sensitive authentication parameters are written to phone logs; no proper security audit trail.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Device binding uses a factory device ID rather than a user-set credential.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
ESP8266 RTOS SDK (Companion App: eWeLink)
|
| Hardware (CPU / GPU)
|
CPU: ESP8285 • GPU:
|
| Memory & Storage
|
Memory: • Storage: 1 MB flash
|
| Power, Battery & Charging
|
Battery: • Power: 90-250 V AC, 10 A max • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 802.11 b/g/n
|
| Physical (Dimensions & Mass)
|
Dimensions: 88 x 38 x 23 mm • Mass: approx. 50 g
|
Overall assessment: Sonoff Basic R3 shows systemic weakness in the eWeLink ecosystem rather than a single bug. The device ID used for cloud binding carries only three random bytes and is not tied to a device secret, making remote takeover practical; ESP-Touch pairing leaks Wi-Fi credentials (CVE-2020-12702); the hardware exposes UART/download mode with no Secure Boot. OTA updates are available and delivered, which is the main mitigating factor.
