Xiaomi Mi Smart Home Hub
From Wiki-IoT
| Xiaomi Mi Smart Home Hub | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Xiaomi Mi Smart Home Hub (3rd gen)
Brand: Xiaomi (Parent: Xiaomi Corporation) Category: Smart-home gateway / ZigBee & Wi-Fi hub • Model / Gen: 3rd DGNWG05LM Release Date: 2020-10-01 • Status: In sale Classification Date: 2025-10-20 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | UART pins present but under epoxy; case requires prying |
| Known vulnerabilities | Very common | 🔗 Proof | Unauth remote code execution in MiWi UPnP stack |
| Prior attacks | Rare | 🔗 Proof | No large-scale botnet recorded yet |
| Updatability | Rare | 🔗 Proof | OTA pushed only in China ROM; global ROM updates delayed ~6 months |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Mi-Account login only; no 2FA for hub itself |
| Communications | Encrypted with obselete encryption | 🔗 Proof | TLS 1.1, weak cipher suites, MiCA cert hardcoded |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Config partition encrypted with AES-ECB, key derivable from firmware |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Mi-Account supports family sharing, roles, revocation |
| Authentication | Basic | 🔗 Proof | Mi-Account username+password; no 2FA for gateway |
| Brute-force protection | Basic | 🔗 Proof | Mi-Account has CAPTCHA & lock-out; hub itself has none |
| Event logging | Partial logging | 🔗 Proof | App shows device join/leave; no syslog export or failed-auth log |
| Passwords | Require change after setup | 🔗 Proof | Mi-Account forces first-login password change; complexity rules applied |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | OpenWrt-based MiWi (Linux 3.10) (Companion App: Mi Home (iOS/Android)) |
| Hardware (CPU / GPU) | CPU: MIPS 24KEc @ 580 MHz (MT7621A) • GPU: None |
| Memory & Storage | Memory: 128 MB DDR3 • Storage: 256 MB NAND flash |
| Power, Battery & Charging | Battery: None (5 V mains) • Power: 5 V ⎓ 1 A via micro-USB • Charging: micro-USB (no battery) |
| Display & Camera | Display: 1 RGB LED ring • Camera: None |
| Sound & Connectivity | Sound: 1 speaker for voice prompts • Connectivity: Wi-Fi 4 (802.11 b/g/n) 2.4 GHz, ZigBee 3.0, Bluetooth LE, Ethernet |
| Physical (Dimensions & Mass) | Dimensions: 90 × 90 × 20 mm • Mass: 133 g |
