HMD Pulse (TA-1589)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	[https://www.hmd.com/en_gb/hmd-pulse/specs https://www.hmd.com/en_gb/press/hmd-pulse-press-release 🔗 Proof]	HMD documents user replacement of the battery, display and charging port. Very common/3 maps accessible hardware under WikiIoT physical-modification criteria; repairability does not itself defeat encrypted data or prove frequent attacks.
Known vulnerabilities	Very common	[https://source.android.com/docs/security/bulletin/2025-11-01 https://www.hmd.com/en_int/security-updates 🔗 Proof]	Android device-type vulnerability history supports a conservative score 3. HMD also disclosed a resolved FOTA cloud misconfiguration; this does not establish affected users, an exploited handset, or exact-model compromise.
Prior attacks	None	[https://www.hmd.com/en_gb/hmd-pulse/specs https://source.android.com/docs/security/bulletin/2025-11-01 🔗 Proof]	Limited manufacturer, Android, NVD and CISA searches on 2026-10-26 found no incident explicitly attributed to this model. None records that search outcome only; unknown incidents remain possible.
Updatability	Rare	[https://www.hmd.com/en_gb/hmd-pulse/specs https://www.hmd.com/en_gb/press/hmd-pulse-press-release 🔗 Proof]	The exact product specification promises three years of quarterly security updates and two OS upgrades. Rare/2 maps the published quarterly cadence, not the number of supported years.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[https://developer.android.com/privacy-and-security/security-ssl https://developer.android.com/privacy-and-security/security-config 🔗 Proof]	TLS server identity checking is supported; mutual authentication depends on the application. Partial is a scoped architecture assessment, not a verified endpoint inventory.
Communications	Encrypted with up-to-date encryption	[https://developer.android.com/about/versions/10/behavior-changes-all https://developer.android.com/privacy-and-security/security-config 🔗 Proof]	Modern platform TLS supports the stated application-traffic profile. This score does not cover every radio protocol or an application that enables plaintext or ignores certificates.
Storage	Encrypted with up-to-date encryption	[https://source.android.com/docs/security/features/encryption/file-based https://www.hmd.com/en_gb/press/hmd-pulse-press-release https://www.hmd.com/en_gb/hmd-pulse/specs 🔗 Proof]	Android requires FBE for devices launched with Android 10+. Applied here as a stock-platform compliance inference for internal user data; no flash extraction was performed.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[https://support.google.com/android/answer/7664951?hl=en https://www.hmd.com/en_gb/declaration-of-conformity 🔗 Proof]	Service accounts can be added and removed. Basic assesses the personal-owner profile; full local role-based administration and enterprise policy are not assumed.
Authentication	Basic	[https://support.google.com/android/answer/9079129?hl=en https://www.hmd.com/en_gb/declaration-of-conformity 🔗 Proof]	Configured PIN/password screen lock is the assessed control. Basic does not certify the recovery path or every preinstalled component; disabled screen lock falls outside scope.
Brute-force protection	Exist	[https://source.android.com/docs/security/features/authentication/gatekeeper https://www.hmd.com/en_gb/declaration-of-conformity 🔗 Proof]	Gatekeeper throttles failed screen-lock credential checks. This is platform design evidence, not a measured vendor delay or a claim about online account limits.
Event logging	Partial logging	🔗 Proof	Android maintains bounded diagnostic logs. Partial does not imply persistent, complete access auditing or an enterprise-managed deployment.
Passwords	Default/Common/Easy to guess	🔗 Proof	Provisional taxonomy mapping: personal Android permits user-selected credentials and optional lock removal. No shared factory password is alleged. Neither forced post-setup replacement option fits; score 3 is conservative and requires reviewer acceptance.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Android 14 launch platform; official supported HMD firmware (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Assessment scope Documentation assessment dated 26 October 2026; no physical inspection or exploit test. Profile: supported official manufacturer firmware, available patches installed, locked bootloader and a strong screen-lock credential. Communication assessment covers correctly validated TLS 1.2/1.3 application connections; arbitrary apps, cellular signaling, SMS, Bluetooth and plaintext integrations are outside this boundary. Storage means internal user-data flash, not every read-only partition or removable card. Platform compliance is an inference, not device testing. The calculated grade applies only to this stated profile. Qualitative mappings and the password-policy mismatch are disclosed for reviewer consideration.

Exact model and release evidence 2024-04-24 is the UK availability date stated by HMD for Pulse and Pulse+. HMD maps Pulse to TA-1589 in UKCA/EU declarations. Pulse+, Pulse Pro and regional TA-1594/TA-1604 are not counted as this exact model. Manufacturer release Exact-model / platform evidence.

Scoring interpretation Vector: 3,3,1,2 / 2,1,1 / 2,2,1,2,3. Category ceiling means: 3,2,2; total 7, provisional profile grade C. Labels are qualitative assessor mappings. The password criterion has no exact fit for user-created Android credentials; score 3 does not allege a shared factory password. If this mapping is rejected, treat the total as unresolved.

Vulnerability and attack scope CVE-2025-48593 is Android platform history, not proof this exact SKU is currently exploitable. Check affected components, installed build and patch level. The limited research found no model-attributed in-the-wild incident; this is not evidence of zero attacks.

Practical risk and improvements Keep physical custody during repairs and protect or erase sensitive data before service; external cards need separate protection. Install security updates, retain bootloader protection, configure a strong unique screen credential, enable account MFA, use trusted applications and validated TLS, and protect external backups independently.

Originality WikiIoT product-family searches on 2026-10-26 did not identify this product. Pending or unindexed submissions remain possible.

Methodology WikiIoT methodology. Classification date and calculator version are reserved for administrators.

Vendor service issue HMD reported a FOTA cloud infrastructure misconfiguration, resolved 2026-08-28 and disclosed 2026-09-25. Potential data exposure is documented; exploited handsets and affected model lists are not established. Official notice. This service issue is not counted as a confirmed prior device attack.