| Nanoleaf Lightstrip (NL60)
|
|
Security Grade
Calculator v
|
Nanoleaf Lightstrip (NL60)
Release Date: 2022-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
—
|
No published hardware-tampering research for this lightstrip was found as of 2026-10. The controller is a sealed adhesive strip with no external ports.
|
| Known vulnerabilities
|
Rare
|
[https://nvd.nist.gov/vuln/detail/CVE-2023-42189
https://nvd.nist.gov/vuln/detail/CVE-2023-45955 🔗 Proof]
|
Two CVEs list the Nanoleaf lightstrip in their CPE configurations. CVE-2023-42189 (CVSS 7.5) is an insecure-permissions flaw in the Matter SDK v1.1.0.0 that also affects the Nanoleaf lightstrip 3.5.10 alongside other vendors' Matter devices. CVE-2023-45955 (CVSS 7.5) lets an attacker cause denial of service on lightstrip 3.5.10 via crafted write-binding attribute commands.
|
| Prior attacks
|
None
|
—
|
No campaign naming this device was found. Lights are a low-value botnet target compared with cameras and routers, and no recorded attack against the Nanoleaf lightstrip exists. Provisional value.
|
| Updatability
|
Rare
|
🔗 Proof
|
Nanoleaf ships firmware through its app, and the Matter support indicates ongoing maintenance, but the lightstrip in question is fixed at 3.5.10 in the CVE records and updates depend on the user keeping the app current.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
CVE-2023-42189 is an insecure-permissions flaw in the Matter SDK, meaning the trust boundary between Matter controllers and the device is not correctly enforced, so authentication with other systems is only partially effective.
|
| Communications
|
Encrypted with up-to-date encryption
|
—
|
Matter and Thread traffic is encrypted by the protocol standard, which is the reason this criterion scores favourably. The older Wi-Fi provisioning path is a separate matter and is not covered by that assessment. Provisional on the provisioning side.
|
| Storage
|
No encryption
|
—
|
No at-rest encryption is documented for the credentials held on the lightstrip controller. Provisional value, not directly evidenced for this model.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
—
|
There is no local user account model on the lightstrip itself; control is delegated to the app and to Matter fabrics. Provisional value, not directly evidenced for this model.
|
| Authentication
|
Basic
|
🔗 Proof
|
Pairing and fabric credentials exist via Matter, but the insecure-permissions flaw in CVE-2023-42189 weakens the authentication boundary the SDK is supposed to enforce.
|
| Brute-force protection
|
Absent
|
—
|
No documented lockout or rate limiting, though the practical attack path here is protocol-level rather than password guessing. Provisional value.
|
| Event logging
|
Absent
|
—
|
The lightstrip keeps no local event log that a user can inspect; any history lives in the app account. Provisional value, not directly evidenced for this model.
|
| Passwords
|
Require change after setup
|
—
|
There is no user-facing password on the device; security depends on Matter pairing codes and fabric credentials rather than a password policy. Provisional value.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded (Matter / Thread firmware) (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi, Thread, Bluetooth LE
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
The Nanoleaf Lightstrip is a Matter and Thread smart LED strip. Two CVEs list the lightstrip in their CPE configurations. CVE-2023-42189 (CVSS 7.5) is notable because it is an insecure-permissions flaw in the Connectivity Standards Alliance Matter SDK v1.1.0.0 itself, affecting the lightstrip at firmware 3.5.10 together with devices from other vendors; that makes it a protocol-level weakness rather than a Nanoleaf-specific coding error. CVE-2023-45955 (CVSS 7.5) allows denial of service against the same firmware via crafted write-binding attribute commands. What keeps the impact bounded is the device class: a lightstrip controls lighting only, so a compromise affects illumination and whatever home network it reaches, not physical safety or surveillance. Matter and Thread do encrypt traffic at the protocol level, which is the one criterion that scores well here. The device is rated D. It is not rated F because neither CVE gives unauthenticated full device takeover, no exploitation campaign was found, and the physical consequence of compromise is limited to lighting. Several values, notably storage encryption, account management and logging, are provisional because no model-level Nanoleaf documentation could be retrieved.
