| Firewalla Purple
|
|
Security Grade
Calculator v
|
Firewalla Purple
Release Date: 2022-02-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[[1] 🔗 Proof]
|
Qualitative physical-access assessment: the RESET button and exposed microSD slot permit a manual reset or installer reflash without an already paired app. Reset requires new pairing and disrupts the existing configuration. Rare reflects the need for physical access, not measured attack prevalence; the box and printed pairing QR label should be secured.
|
| Known vulnerabilities
|
Rare
|
[[2] 🔗 Proof]
|
CVE-2024-40892 (Bluetooth credential weakness) and CVE-2024-40893 (command injection) are isolated published examples affecting Firewalla Box software before 1.979, including Purple. The current production matrix lists 1.983; historical evidence does not imply the patched version has those flaws.
|
| Prior attacks
|
Rare
|
[[3] 🔗 Proof]
|
GreyNoise's 2024 primary research includes a successful root-code-execution demonstration on Firewalla Purple using CVE-2024-40893. This is a documented research attack, not evidence of widespread malicious exploitation or a measured incident rate.
|
| Updatability
|
Very common
|
[[4] 🔗 Proof]
|
Box software updates are automatic. Purple remains in the current release matrix despite end of sale.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[[5] 🔗 Proof]
|
Management uses paired public/private keys. This establishes authenticated management peers, not universal mutual authentication for every network service or forwarded client connection.
|
| Communications
|
Encrypted with obselete encryption
|
[[6] 🔗 Proof]
|
Conservative rating of the retained legacy-compatible management path: official source accepts AES-256-CBC with a fixed zero IV and mirrors that request format in replies. Newer GCM with fresh nonces also exists and cloud links use HTTPS. This label concerns the supported legacy path, not all current traffic or the strength of AES itself.
|
| Storage
|
No encryption
|
[[7] 🔗 Proof]
|
Source-based assessment: device management private keys are exported as unencrypted PKCS#1 PEM and written directly to local files. This establishes unencrypted application storage of sensitive data; network end-to-end encryption does not protect these files. No chip-level or full-disk forensic test was performed.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
[[8] 🔗 Proof]
|
Paired devices can be revoked. Optional paid MSP offers Full/Limited/No Access, but Limited only hides settings and is not strict privilege isolation; newly paired devices default to Full Access.
|
| Authentication
|
Basic
|
[[9] 🔗 Proof]
|
App management uses paired cryptographic keys, with optional biometric/PIN app lock. Physical reset/reflash is documented; reviewed sources do not establish signed-only recovery or proof of ownership during physical recovery.
|
| Brute-force protection
|
Basic
|
[[10] 🔗 Proof]
|
For the LAN SSH service, the vendor config retains OpenSSH defaults including MaxAuthTries 6 and connection-start limits. These limit attempts per connection but do not establish durable account lockout. Applies to the standard config without custom overrides; app pairing uses keys instead of a typed password.
|
| Event logging
|
Partial logging
|
[[11] 🔗 Proof]
|
VPN client connections generate alarms; network flows are recorded. This is partial event visibility, not proof of a complete administrator access audit.
|
| Passwords
|
Require change after setup
|
[[12] 🔗 Proof]
|
Closest rubric option for the optional SSH login: official instructions require Reset Password before first SSH use; the password rotates on reboot/support access. App management itself uses pairing keys and has no conventional shared login password. This is not a claim of mandatory user-selected complexity.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Ubuntu-based Firewalla software; precise base image depends on installed firmware (Companion App: Firewalla mobile app for iOS/Android; optional Firewalla MSP web management)
|
| Hardware (CPU / GPU)
|
CPU: 6-core 64-bit ARM processor • GPU: Not applicable to normal operation: headless router; no graphics processor specification published
|
| Memory & Storage
|
Memory: 2 GB • Storage: 16 GB; microSD slot for recovery/customization
|
| Power, Battery & Charging
|
Battery: No internal battery specified; external power required • Power: 5 V DC, 3 A USB-C power adapter; approximately 7-9 W • Charging: Not applicable; USB-C is power input
|
| Display & Camera
|
Display: Status LEDs; no integrated display • Camera: No integrated camera listed
|
| Sound & Connectivity
|
Sound: No integrated speaker or microphone listed • Connectivity: 2 Gigabit Ethernet ports; short-range Wi-Fi WAN/LAN; Bluetooth for initial pairing; USB 2.0 expansion port (not supported in installation guide).
|
| Physical (Dimensions & Mass)
|
Dimensions: 90 x 60 x 30 mm • Mass: 110 g
|
Desk research dated 2026-10-23; no physical testing or security certification. Original Purple in router mode, paired app management and LAN-only SSH. Public launch date is 2022-02-01; global/US end of sale was February/April 2026, with continued software support. Historical CVEs before 1.979 are separated from current 1.983 production context. Communications rating explicitly covers the supported legacy-compatible CBC path; newer GCM and HTTPS paths also exist, and no live session was inspected. At-rest rating is based on local unencrypted PEM-key storage in published source, not a physical flash examination. Incident categories reflect published evidence, not measured attack rates. None means no qualifying incident identified, not zero risk.
Physical tampering is an assessor rating of accessible reset/reflash interfaces and the physical-access requirement; it is not an incident-frequency statistic.
Release-date scope: Public launch and availability for purchase in the dated manufacturer press release; earlier crowdfunding is distinct.
Product status: End of sale. Official guide: global end of sale February 2026, US April 2026; software support continues.
Proposed IDRS calculation under the assessment scope above: Device 2, System 3, User Authentication 2, total 7, grade C. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.
Firmware scope: Original Purple, not Purple SE, in router mode with LAN-only SSH. Current production matrix lists Box 1.983; historical CVEs affect versions before 1.979. Open-source management code also retains a legacy-compatible encrypted path; its limitations are explicitly assessed, without claiming every current session uses it.
Additional references:
