| SwitchBot Curtain 3 (W0701600)
|
|
Security Grade
Calculator v1
|
SwitchBot Curtain 3 (W0701600)
Release Date: 2023-06-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Mounted at curtain rail height; no public report of an exposed debug interface for this model, though CVE-2025-64983 shows debug code left active on a sibling product.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Four CVEs are tracked for the brand: CVE-2024-48786 (CVSS 9.1, sensitive information exposed through the firmware update process), CVE-2025-64983 (Telnet debug code), CVE-2025-53649 (sensitive data written to logs) and CVE-2026-8374 (weak IVs and risky cryptographic primitives in Bluetooth communication).
|
| Prior attacks
|
None
|
🔗 Proof
|
None of the tracked SwitchBot CVEs appear in CISA KEV and all carry EPSS below 1%.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware is delivered over the air through the SwitchBot app, including version 2.01.078 which removed the Telnet debug code.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
CVE-2026-8374 demonstrates that Bluetooth pairing on the SwitchBot Lock line relies on weak initialization vectors and unsafe primitives, indicating brand-wide weaknesses in BLE session protection.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
The same research reports misuse and misconfiguration of Bluetooth communication that allows protocol manipulation by an unauthenticated attacker in proximity.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
CVE-2025-53649 shows sensitive information being written to log files; no encryption at rest is documented.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
SwitchBot account with home member sharing and limited role granularity.
|
| Authentication
|
Basic
|
🔗 Proof
|
CVE-2024-48786 (CVSS 9.1) allows a remote attacker to obtain sensitive information through the firmware update process.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout for the app or hub.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app writes sensitive information into log files, showing that log handling is not designed as a security control.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Access depends on the SwitchBot cloud account; no device-local password policy.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: SwitchBot App)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: Rechargeable lithium battery, approx. 8 months per charge • Power: Battery, USB-C charging • Charging: USB-C, optional solar panel
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Bluetooth LE, Wi-Fi via SwitchBot Hub
|
| Physical (Dimensions & Mass)
|
Dimensions: 127 x 86 x 76 mm • Mass: approx. 400 g
|
Overall assessment: Risk for the Curtain 3 comes from brand-level findings rather than model-specific ones. Four SwitchBot CVEs are tracked, the most severe being CVE-2024-48786 (CVSS 9.1, information exposure through the firmware update process) and CVE-2026-8374 (weak IVs and unsafe primitives in Bluetooth pairing, from Neodyme research on the Lock line). None of them appear in CISA KEV and all have EPSS below 1%, so active exploitation is not observed, and the vendor does ship OTA updates - notably version 2.01.078 which removed the Telnet debug code. The device itself is BLE-only for direct control and relies on a SwitchBot Hub for cloud access, which limits remote exposure.
