You do not have permission to edit this page, for the following reasons:
Documentation-based security assessment: Sensi Touch 2 smart thermostat (ST76 / ST76W, 1F96U-42WF series). Reviewed 2026-10-24. Documentation-based assessment of a defined Sensi profile. The thermostat is set up through the Sensi app on iOS/Android and bound to a single Sensi cloud account; the account uses a self-chosen password but optional 2FA is not enabled in this profile. The default Sensi-app-to-cloud TLS channel is used; BLE is used only during initial pairing. Third-party integrations with Amazon Alexa, Google Assistant and Samsung SmartThings are linked through the Sensi cloud via OAuth rather than local per-device mutual authentication; HomeKit is not enabled on ST76. Power is hardwired 24 VAC via a C-wire. Firmware updates are offered infrequently through the Emerson vulnerability-remediation process and applied from the app when available. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit. Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform-level history; no Sensi thermostat CVE or in-the-wild attack record is on file. Optional capabilities (e.g. 2FA, HomeKit, local per-device auth) are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected current firmware remains vulnerable. Release-date scope: 2022-06-28, the date ST76W is registered as "Sensi Touch 2" in the PSE qualified products list; the retail spec sheet and user manual are dated 2022. Not asserted to be the earliest worldwide retail date. Historical vulnerability: none on record. NVD contains no CVE against Sensi ST76 / 1F96U series or any Sensi Wi-Fi thermostat; the only Emerson CVE in NVD in this window (CVE-2025-48496) concerns Emerson ValveLink industrial software, not Sensi thermostats. No physical device was tested. Keep the configuration and evidence scope with the ratings. References: [https://sensi.copeland.com/documents/sensi-touch-2-smart-thermostat-retail-spec-sheet-en-8725760.pdf Sensi — Touch 2 retail spec sheet (R-5530, ©2022)] [https://sensi.copeland.com/en-us/support/is-my-thermostat-a-sensi Sensi — Which Sensi thermostat do I have? (ST76 = Touch 2)] [https://cdn.acpro.com/documents/Emerson-sensi-touch-2-smart-thermostat-user-manual.pdf Sensi Touch 2 user manual (R-5580, June 2022)] [https://www.pse.com/-/media/PDFs/REBATES/Qualifying-product-lists/PSE_Earth_Day_LTO_QPL.pdf?sc_lang=en&modified=20230331211333&hash=D05ACA623BB613BFC2A6EF4859 PSE qualified products list — ST76W Sensi Touch 2 certified 2022-06-28] [https://manuals.plus/m/2d63f70446bae4cb73c24933965f7709f77fd27f1065388811b3db4332160c59 Emerson — Sensi Thermostat Networking and Security Guide] [https://sensi.copeland.com/en-us/support/finding-sensi-thermostat-security-code Sensi — Where to find your Security Code / PIN] [https://nvd.nist.gov/vuln/search/results?query=sensi+thermostat NVD search — "sensi thermostat" (no thermostat CVE)] [https://nvd.nist.gov/vuln/detail/CVE-2025-48496 NVD — CVE-2025-48496 (Emerson ValveLink, not Sensi)] [https://fehmijaafar.net/wiki-iot/index.php/Methodology WikiIoT methodology]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
