AVM FRITZ!DECT 200 (DECT 200)

AVM FRITZ!DECT 200 (DECT 200)
Security Grade B Calculator v1	AVM FRITZ!DECT 200 Brand: AVM (Parent: AVM GmbH (FRITZ!)) Category: Smart plug • Model / Gen: DECT 200 DECT 200 Release Date: 2013-01-01 • Status: End of sale Classification Date: 2026-10-24 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Plug enclosure with no publicly documented service connector or debug interface; AVM publishes a dedicated security advisory page and states its products are not affected by the KadNa and Avrecon botnets.
Known vulnerabilities	Rare	🔗 Proof	No CVE is recorded against the DECT 200 itself. The brand-level CVE-2014-8886 affects FRITZ!OS before 6.30, which runs on the FRITZ!Box gateway rather than on the DECT plug.
Prior attacks	None	🔗 Proof	AVM states that no botnet malware is active on its products, and no attack report specifically targeting DECT smart plugs was found.
Updatability	Very common	🔗 Proof	FRITZ!OS receives frequent updates and DECT device firmware is updated through the FRITZ!Box, which remains supported for many years after release.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The device is bound to a specific FRITZ!Box over encrypted DECT and inherits its user administration, but the pairing and registration mechanism of DECT ULE devices is not documented in detail by the vendor.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Communication with the FRITZ!Box runs over encrypted DECT ULE and local management is offered over HTTPS; AVM also provides VPN for remote access instead of exposing ports.
Storage	Encrypted with obselete encryption	🔗 Proof	No vendor documentation of encryption at rest for configuration and consumption data held on the plug.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	FRITZ!OS supports multiple user accounts with separate rights, including restricted Smart Home only users, so permissions can be separated per person.
Authentication	Basic	🔗 Proof	Control depends on a FRITZ!Box login session; push service and MyFRITZ! access use separate credentials but no second factor is mandatory.
Brute-force protection	Basic	🔗 Proof	FRITZ!OS reacts to repeated failed login attempts, but no formal lockout policy is published.
Event logging	Access event logged	🔗 Proof	FRITZ!OS keeps an event log covering system, login and Smart Home switching events.
Passwords	Require change after setup	🔗 Proof	Each FRITZ!Box ships with its own pre-printed password and FRITZ!OS evaluates password strength, but complexity is not strictly enforced.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded DECT ULE firmware (managed by FRITZ!OS) (Companion App: FRITZ!App Smart Home (iOS / Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: None • Power: 230 V AC, 50 Hz, up to 2300 W • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: DECT ULE (via a FRITZ!Box with Smart Home base station)
Physical (Dimensions & Mass)	Dimensions: approx. 70 x 70 x 50 mm (excluding plug pins) • Mass: approx. 130 g

Overall assessment: The DECT 200 has no CVE of its own and the brand-level CVE-2014-8886 concerns FRITZ!OS on the FRITZ!Box gateway, not this plug. Its score comes largely from vendor security governance rather than the device itself: AVM publishes a dedicated security page and states that botnets such as KadNa and Avrecon are not active on its products, FRITZ!OS supports multiple accounts with separate rights including Smart Home only users, remote access is offered through VPN rather than exposed ports, and an event log covers login and switching activity. DECT ULE traffic to the FRITZ!Box is encrypted and firmware is maintained through the gateway for many years. The weaker points are undocumented encryption at rest on the plug, the absence of a mandatory second factor, and no formal brute-force lockout policy.