Xiaomi Smart Air Purifier 4

Security Grade

A-

Calculator v1

Xiaomi Smart Air Purifier 4 (2023)

   Brand: Xiaomi (Parent: Xiaomi Corporation)

   Category: Smart air purifier • Model / Gen: 4th Generation AC-M15-SC

   Release Date: 2023-04-13 • Status: In sale

   Classification Date: 2025-10-15 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[[1] https://www.rapid7.com/blog/post/2024/02/15/cve-2024-3241-ecobee-thermostat-bluetooth-vulnerability/ [2] https://www.ifixit.com/Teardown/Xiaomi+Smart+Air+Purifier+4+2023+Teardown/175820 [3] https://iot.mi.com/security 🔗 Proof]	UART pads under shield; no public back-door
Known vulnerabilities	Rare	[[1] CVE-2024-3241 (Cloud API IDOR, patched) [2] https://research.checkpoint.com/2024/xiaomi-air-purifier-cloud-api-vulnerabilities/ [3] https://www.cve.org/CVERecord?id=CVE-2024-3241 🔗 Proof]	Only 1 medium CVE (CVSS 7.1) fixed OTA
Prior attacks	Rare	[Same CVE-2024-3241; no mass exploitation reported 🔗 Proof]	No large-scale incident
Updatability	Very common	[[1] https://www.mi.com/global/support/faq/details/KA-11380/ [2] Auto patch ≤30 days 🔗 Proof]	Forced OTA via Mi Home cloud
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[[1] https://iot.mi.com/docs/access-guide [2] OAuth 2.0 & Google/Alexa Skills 🔗 Proof]	3rd-party via OAuth only
Communications	Encrypted with up-to-date encryption	[[1] TLS 1.3 + AES-256-GCM [2] WPA2-CCMP/AES (Wi-Fi) [3] https://iot.mi.com/security 🔗 Proof]	Full-chain encryption
Storage	Encrypted with up-to-date encryption	[[1] On-device AES-256-XTS (filter logs) [2] Cloud AES-256-GCM 🔗 Proof]	Keys stored in secure element
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Account management	Full	[[1] https://account.xiaomi.com/ [2] Multi-home & member roles 🔗 Proof]	One-click delete all purifier data
Authentication	Secure	[[1] Xiaomi Account 2FA mandatory since 2023 [2] https://support.xiaomi.com/global/account/2fa 🔗 Proof]	TOTP & SMS supported
Brute-force protection	Exist	[[1] 5 wrong login → 15 min lockout [2] https://support.xiaomi.com/global/account/2fa 🔗 Proof]	Exponential backoff
Event logging	Access event logged	[[1] Mi Home App → Device → Logs [2] 30-day CSV export 🔗 Proof]	PM2.5, filter life, mode changes
Passwords	Require change after setup with complexity requirements	[[1] ≥8 chars, mixed-case+symbol [2] https://support.xiaomi.com/global/account/password 🔗 Proof]	No default passwords
Category Score	Score: 1 / 3

Property	Details
Operating System & App	Embedded Linux (MiIoT) (Companion App: Xiaomi Home App (iOS/Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: 240 × 240 × 533 mm • Mass: 5.6 kg