Tuya Smart Plug (Generic Wi-Fi Smart Plug)

From Wiki-IoT



Tuya Smart Plug (Generic Wi-Fi Smart Plug)
Security Grade
   
     F
Calculator v1
Tuya Smart Plug (Generic Wi-Fi Plug, ESP8266/WB2S, white-label)
   Brand: Tuya (OEM/ODM) (Parent: Tuya Inc.)

   Category: Smart outlet (Wi-Fi controlled) • Model / Gen: 2nd (WB2S replaces ESP8266) WB2S module inside, e.g., SH-P01, KS-602S, etc.

   Release Date: 2019-11-11 • Status: In sale

   Classification Date: 2025-10-20 • Official Website

Security Evaluation

1. Device Security

Criterion Value Proof Comment
Known hardware tampering Very common 🔗 Proof Plastic case snaps open; WB2S UART pins labelled & accessible
Known vulnerabilities Very common 🔗 Proof WB2S TuyaOS ≤ 2.9.5 stack overflow (remote code exec) patched 2021-09
Prior attacks Very common 🔗 Proof Mirai off-shoot “Tuyai” botnet brute-forces Tuya plugs via weak creds
Updatability Rare 🔗 Proof OTA exists but vendor must push; white-label sellers rarely update
Category Score Score: 3 / 3

2. System Security

Criterion Value Proof Comment
Authentication with other systems Partial 🔗 Proof Local web server on 10.42.42.1 no login required for config dump
Communications Encrypted with obselete encryption 🔗 Proof TLS 1.1, hard-coded cert, AES-ECB key reused across devices
Storage No encryption 🔗 Proof Flash dump in plaintext; Wi-Fi creds stored in clear text
Category Score Score: 3 / 3

3. User Authentication

Criterion Value Proof Comment
Account management Basic 🔗 Proof Tuya STuya Smart app login only; no 2FA on device levelmart app login only; no 2FA on device level
Authentication Basic 🔗 Proof SamsTuya Smart app login only; no 2FA on device levelung-account + 2FA (TOTP, WebAuthn, push)
Brute-force protection Absent 🔗 Proof AccoNo lock-out, no CAPTCHA; Mirai dictionaries workunt lock-out & CAPTCHA after 5 failed attempts
Event logging Partial logging 🔗 Proof App shows on/off events; no syslog, no failed-login log
Passwords Default/Common/Easy to guess 🔗 Proof Many sellers ship with admin/admin; no forced change, no complexity
Category Score Score: 3 / 3

Technical Specifications

Property Details
Operating System & App TuyaOS-Lite (FreeRTOS-based) on WB2S (Companion App: Tuya Smart / Smart Life (iOS/Android))
Hardware (CPU / GPU) CPU: ARM Cortex-A7 @ 720 MHz (NXP i.MX6 UltraLite) • GPU: None
Memory & Storage Memory: 256 KB SRAM + 2 MB XIP flash (chip-package) • Storage: 2 MB XIP flash (no encryption)
Power, Battery & Charging Battery: None • Power: 230 V AC, max 16 A, standby ≤ 0.5 W • Charging: Not applicable
Display & Camera Display: 1 hidden RGB LED (status) • Camera: None
Sound & Connectivity Sound: None • Connectivity: Wi-Fi 4 (802.11 b/g/n) 2.4 GHz only, no BLE/Ethernet
Physical (Dimensions & Mass) Dimensions: 55 × 55 × 52 mm (typical EU plug) • Mass: 65 g


Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Tuya_Smart_Plug_(Generic_Wi-Fi_Smart_Plug)&oldid=8336"