| IKEA TRADFRI LED Bulb E27 (LED1732G11)
|
|
Security Grade
Calculator vv1
|
IKEA TRADFRI LED Bulb E27
Category: Smart bulb • Model / Gen: TRADFRI LED1732G11
Release Date: 2019-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
Bulb form factor with no service connector and no public teardown reporting an accessible debug interface or UART.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
CVE-2022-39064 (CVSS 7.1) is model-specific and affects all versions of the TRADFRI LED bulb 1732G11: a malformed IEEE 802.15.4 frame forces a factory reset. The vendor states that no update fully resolves it and only mitigates part of the crafted frame variants, while the companion gateway issue CVE-2022-39065 (CVSS 6.5) was fixed in firmware 1.19.26.
|
| Prior attacks
|
None
|
🔗 Proof
|
Neither CVE appears in CISA KEV and EPSS is around 0.4 percent; no in-the-wild abuse has been reported, and IKEA states the issues do not expose sensitive information.
|
| Updatability
|
Rare
|
🔗 Proof
|
IKEA released V-2.3.091, which the researcher assessment describes as only partially addressing the crafted frames, and no update fully fixes CVE-2022-39064.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Zigbee 3.0 protects the network with a shared network key, but the vulnerable frame is an unauthenticated broadcast, so any device in radio range can act on the bulb without joining the network.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Zigbee 3.0 applies AES-128 network layer encryption, and the reported issues are availability problems rather than a break of the transport encryption.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No vendor documentation of encryption at rest for network keys and settings held in the bulb.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
IKEA Home Smart account with household sharing and no documented role separation.
|
| Authentication
|
Basic
|
🔗 Proof
|
Control runs through the gateway and app account; the bulb itself has no authentication and accepts unauthenticated broadcast frames.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout for the IKEA Home Smart app.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app exposes limited device status and no full security audit log.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Access depends on the IKEA Home Smart cloud account; no device local password policy.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Zigbee) (Companion App: IKEA Home Smart app (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: None • Power: E27 base, 220-240 V AC, 8.6 W (806 lm) • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Zigbee 3.0 (IEEE 802.15.4), requires TRADFRI gateway or DIRIGERA hub
|
| Physical (Dimensions & Mass)
|
Dimensions: approx. 60 x 60 x 110 mm • Mass: approx. 90 g
|
Overall assessment: Unlike most devices in this batch, the decisive issue here is model-specific. CVE-2022-39064 (CVSS 7.1) affects all versions of the TRADFRI LED bulb 1732G11: a malformed IEEE 802.15.4 frame forces a factory reset, and IKEA states that no update fully resolves the issue - release V-2.3.091 only mitigates part of the crafted frame variants. Updatability is therefore rated as rare. The impact is limited because the flaw is an availability problem: IKEA states no sensitive information is exposed, neither CVE is in CISA KEV and EPSS stays around 0.4 percent. The companion gateway issue CVE-2022-39065 was fixed in firmware 1.19.26. Transport security itself is sound - Zigbee 3.0 applies AES-128 network layer encryption - but the attack uses an unauthenticated broadcast frame, so an attacker in radio range does not need to join the network. Account handling is basic and no encryption at rest for network keys is documented.
