| Sonoff S26 Smart Plug (S26)
|
|
Security Grade
Calculator v1
|
Sonoff S26 Smart Plug (S26)
Release Date: 2019-04-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Very common
|
🔗 Proof
|
The S26 enclosure is trivially opened and the programming header is exposed; third-party firmware flashing is widespread. Open debug interfaces and missing Secure Boot are documented across the Sonoff line.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Cloud-side device takeover plus Wi-Fi credential disclosure during pairing (CVE-2020-12702).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Documented attack path demonstrated by researchers; no large-scale exploitation observed
|
| Updatability
|
Very common
|
🔗 Proof
|
Updates are delivered through the eWeLink app; control of the update URL by an attacker was part of the reported impact.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The cloud API accepts a device registration request without checking whether the device already belongs to another account.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
ESP-Touch quick pairing discloses full Wi-Fi credentials (CVE-2020-12702).
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No Secure Boot; firmware and stored credentials can be extracted via the debug interface.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Server-side authorization is incomplete: only the login token is checked, device ownership is not.
|
| Authentication
|
Basic
|
🔗 Proof
|
Device key material leaks through logs, Bluetooth pairing and the shared-homepage endpoint.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
Bitdefender states the flaw lets a remote user take over any device by guessing or brute-forcing its unique ID, indicating no effective throttling.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Sensitive parameters reach mobile logs; no security-grade audit logging.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Authentication relies on the eWeLink account; no enforced complexity policy documented.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
ESP8266 RTOS SDK (Companion App: eWeLink)
|
| Hardware (CPU / GPU)
|
CPU: ESP8266EX • GPU:
|
| Memory & Storage
|
Memory: • Storage: 1 MB flash
|
| Power, Battery & Charging
|
Battery: • Power: 100-240 V AC, 10 A max • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 802.11 b/g/n
|
| Physical (Dimensions & Mass)
|
Dimensions: 100 x 57 x 60 mm • Mass: approx. 90 g
|
Overall assessment: The S26 inherits the eWeLink platform weaknesses documented by Bitdefender: the cloud API does not verify device ownership, and the short device ID makes remote takeover by guessing practical. Physically, the enclosure opens easily and the programming header is exposed with no Secure Boot, so firmware and stored credentials can be extracted. OTA updates exist but the update URL itself was part of the reported attack surface. This is the weakest device in this batch.
