| Wemo Smart Plug with Thread (WSP100) | ||
|---|---|---|
|
Security Grade
Calculator v
|
Wemo Smart Plug with Thread
Category: Smart Plug • Model / Gen: 1st Generation WSP100 Release Date: 2021-06-01 • Status: In sale Classification Date: • Official Website | |
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Plug casing, side button and printed HomeKit code are physically accessible; no tamper-resistant enclosure documented. |
| Known vulnerabilities | Rare | 🔗 Proof | No model-specific CVE for WSP100, but the Wemo plug family has CVE-2018-6692 (RCE in Wemo Insight plug), so rated Rare rather than None. |
| Prior attacks | None | 🔗 Proof | No Wemo entry in the CISA Known Exploited Vulnerabilities catalog; no model-specific exploitation campaign found. |
| Updatability | Very common | 🔗 Proof | Firmware updates delivered through the HomeKit ecosystem and Belkin's support portal. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Full | 🔗 Proof | Works exclusively with Apple HomeKit; all integrations (Siri, Home app, HomePod hub) pass HomeKit mutual authentication. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Thread mandates AES-128-CCM network-layer encryption; HomeKit adds per-session encryption. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | HomeKit pairing keys stored on local flash; Belkin does not publicly document at-rest encryption, so rated conservatively. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Ownership managed via Apple ID / Home app: multiple users, distinct permissions, password change and deletion supported. |
| Authentication | Secure | 🔗 Proof | Pairing requires the unique 8-digit HomeKit setup code; Apple ID supports two-factor authentication. |
| Brute-force protection | Exist | 🔗 Proof | Failed pairing attempts are rejected; Apple ID login enforces lockout and rate-limiting. |
| Event logging | Partial logging | 🔗 Proof | Home app shows accessory activity history, but a full administrator audit log is not documented. |
| Passwords | Require change after setup with complexity requirements | 🔗 Proof | No shared default password: pairing uses a unique per-unit 8-digit code; Apple ID enforces complexity rules. |
| Category Score | Score: 2 / 3 | ||
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (Apple HomeKit accessory firmware) (Companion App: Apple Home app (iOS)) |
| Hardware (CPU / GPU) | CPU: Not publicly documented • GPU: N/A |
| Memory & Storage | Memory: Not publicly documented • Storage: On-board flash (firmware & HomeKit pairing keys) |
| Power, Battery & Charging | Battery: None • Power: AC 120 V, 60 Hz, 15 A (max load 1800 W) • Charging: N/A (mains-powered) |
| Display & Camera | Display: LED status indicator • Camera: None |
| Sound & Connectivity | Sound: None • Connectivity: Thread (IEEE 802.15.4) + Bluetooth LE 5.0, NFC pairing |
| Physical (Dimensions & Mass) | Dimensions: 53.7 × 30 × 35.7 mm • Mass: approx. 55 g (1.95 oz) |
Graded with IDRS Calculator v1: Device Security CATS=2 (avg 1.5→ceil), System Security CATS=2 (avg 1.33→ceil), User Authentication CATS=2 (avg 1.2→ceil). GRAS = 6 → Grade B. All proofs retrieved 2026-10-27. Note: CVE-2018-6692 affects the Wemo Insight Smart Plug (family-level), not the WSP100 itself.
