(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Dragino LWL04 LoRaWAN Water Leak Sensor
|
|
Security Grade
Calculator v1
|
Dragino LWL04 LoRaWAN Water Leak Sensor
Release Date: 2023-05-12 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The enclosure can be opened for battery replacement and the device exposes an internal UART interface. Physical access may allow hardware manipulation.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No LWL04-specific published vulnerability was established in this review. This rating is provisional and does not imply that the device is vulnerability-free.
|
| Prior attacks
|
None
|
🔗 Proof
|
No confirmed LWL04-specific attack was identified in the reviewed materials. This is a provisional rating.
|
| Updatability
|
Very common
|
🔗 Proof
|
The manufacturer supports firmware updates through wireless OTA and a UART TTL interface.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
The device uses LoRaWAN OTAA with unique registration keys to join the network server.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The sensor uses LoRaWAN 1.0.3, which specifies AES-128-based communication security when correctly configured.
|
| Storage
|
No encryption
|
🔗 Proof
|
The device stores sensor readings for later retrieval. The documentation does not establish encryption at rest, so this is a conservative assumption rather than a verified absence.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
The sensor does not document a local multi-user account management interface. Accounts may instead be managed by an external LoRaWAN server.
|
| Authentication
|
Basic
|
🔗 Proof
|
The device uses unique LoRaWAN activation keys, but a separate local user-login authentication system is not documented.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
No device-level user-login rate limiting or lockout mechanism is documented. This selection is provisional.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The sensor stores water leak events and periodic measurements, but these are operational logs rather than verified user access audit logs.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The sensor uses unique LoRaWAN keys rather than a documented initial user password. This is a forced-choice proxy, not evidence of a weak default password.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (not publicly specified) (Companion App: LoRaWAN network server dashboard (e.g. The Things Stack))
|
| Hardware (CPU / GPU)
|
CPU: Not publicly specified • GPU: None specified
|
| Memory & Storage
|
Memory: Not publicly specified • Storage: Not publicly specified
|
| Power, Battery & Charging
|
Battery: CR123A 1500mAh replaceable battery • Power: Battery powered • Charging: Not rechargeable
|
| Display & Camera
|
Display: Status LEDs • Camera: None
|
| Sound & Connectivity
|
Sound: No speaker specified • Connectivity: LoRaWAN Class A v1.0.3; OTAA
|
| Physical (Dimensions & Mass)
|
Dimensions: Not publicly specified • Mass: Not publicly specified
|
The Dragino LWL04 is a battery-powered LoRaWAN water leak sensor designed for smart buildings and industrial monitoring. It detects water contact through three metal probes and transmits alerts to a LoRaWAN network server.
The device supports LoRaWAN 1.0.3, OTAA network activation with unique device keys, and wireless firmware updates. These are documented security-relevant capabilities.
However, the public documentation does not fully establish the security of local credential storage, physical tamper resistance, management-platform password policies, brute-force protection or security audit logging.
Security conclusions about the management platform depend on the selected LoRaWAN network server and its configuration. Unknown controls should not automatically be treated as absent.
References:
https://wiki.dragino.com/docs/LoRaWAN-End-Node/door-water-leak-contact-sensors/lwl04/
https://www.dragino.com/products/lorawan-nb-iot-door-sensor-water-leak/item/344-lwl04.html
