| Aqara Temperature and Humidity Sensor (WSDCGQ11LM)
|
|
Security Grade
Calculator v1
|
Aqara Temperature and Humidity Sensor
Category: Sensor • Model / Gen: 1st Generation WSDCGQ11LM
Release Date: 2018-01-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Fully sealed one-piece casing with no exposed ports or debug headers; only the coin-cell cover is user-accessible.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
No model-specific CVE for the WSDCGQ11LM sensor; known Aqara-family vulnerabilities (e.g. hub-side CVE-2020-28194) concern the Aqara Hub, not this device.
|
| Prior attacks
|
None
|
🔗 Proof
|
No Aqara entry in the CISA Known Exploited Vulnerabilities catalog; no public exploitation campaign targeting this sensor.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware updates are delivered over-the-air through the Aqara Hub and the Aqara Home app.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
The sensor only communicates through a paired Aqara Hub; hub-mediated integrations (HomeKit, Alexa) require mutual authentication at the hub level, so no unauthenticated path to the sensor exists.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Zigbee 3.0 mandates AES-128-CCM network-layer encryption for all frames between the sensor and the hub.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The sensor stores only calibration values and network keys locally; no user data resides on the device, and hub/cloud sync is AES-128 encrypted per the Aqara privacy policy.
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Access is managed through the Aqara account and Home app with family-sharing roles, password change and account deletion.
|
| Authentication
|
Secure
|
🔗 Proof
|
Sensor pairing requires hub-side approval (long-press pairing button); Aqara account login supports SMS/email verification.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Zigbee network joining requires hub approval during pairing mode; the account layer enforces failed-login limits.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app records temperature/humidity history and device status, but no full access audit log is documented.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
The sensor itself has no password (secured by Zigbee network keys); the controlling Aqara account enforces complexity rules.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Zigbee end device) (Companion App: Aqara Home (via Aqara Hub); Apple HomeKit through HomeKit-enabled Aqara Hub)
|
| Hardware (CPU / GPU)
|
CPU: Not publicly documented • GPU: —
|
| Memory & Storage
|
Memory: Not publicly documented • Storage: On-board flash (calibration data & network keys)
|
| Power, Battery & Charging
|
Battery: CR2032 coin cell • Power: 3 V DC (CR2032) • Charging: N/A (replaceable battery)
|
| Display & Camera
|
Display: Small e-ink display (temperature / humidity / pressure) • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: Zigbee 3.0 (2.4 GHz) — requires Aqara Hub
|
| Physical (Dimensions & Mass)
|
Dimensions: 33 × 33 × 23 mm • Mass: approx. 26 g (incl. CR2032 battery)
|
Graded with IDRS Calculator v1: Device Security CATS=2, System Security CATS=2, User Authentication CATS=2. GRAS = 6 → Grade B. All proofs retrieved 2026-10-27. Notes: the sensor has no direct cloud or Wi-Fi path; all communication is via a paired Zigbee hub. CVE-2020-28194 affects the Aqara Hub, not this sensor.
