| Netatmo Smart Thermostat (NTH01)
|
|
Security Grade
Calculator vv1
|
Netatmo Smart Thermostat
Release Date: 2021-01-12 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
Wall mounted or table top thermostat with no exposed service connector and no public teardown reporting an accessible debug interface.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No CVE entry matching Netatmo was found in the NVD at the time of classification.
|
| Prior attacks
|
None
|
🔗 Proof
|
No public report of botnet recruitment or exploitation of Netatmo thermostats was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
Netatmo delivers firmware updates over the air through the app and keeps the cloud API versioned.
|
| Category Score
|
Score: 1 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Integration with third party systems runs through the Netatmo Connect API using OAuth 2.0, but the radio link between thermostat and receiver is not documented as cryptographically authenticated.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Cloud and app communication use HTTPS with TLS, and the vendor documents encryption of exchanges with its servers.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
Measurement history is stored in the vendor cloud in the European Union under a GDPR privacy policy, but no encryption at rest is documented for data held on the device itself.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Netatmo account with home member sharing and limited role granularity.
|
| Authentication
|
Basic
|
🔗 Proof
|
E-mail and password login with OAuth based third party access; no mandatory second factor is documented.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
No published documentation of failed-attempt lockout for the cloud account.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Temperature and schedule history are available; no full security audit log is documented.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
The account is created during setup; no enforced complexity policy is published.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Companion App: Netatmo app / Home + Control app (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: N/A • GPU: N/A
|
| Memory & Storage
|
Memory: N/A • Storage: N/A
|
| Power, Battery & Charging
|
Battery: Backup battery in the thermostat module • Power: Mains powered receiver or boiler module • Charging: N/A
|
| Display & Camera
|
Display: E-ink display with control dial • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: Wi-Fi 802.11 b/g/n, Bluetooth LE, radio link to the receiver
|
| Physical (Dimensions & Mass)
|
Dimensions: approx. 80 x 80 x 22 mm • Mass: approx. 180 g
|
Data sources: official Netatmo documentation (netatmo.com, dev.netatmo.com) and the NVD vulnerability database (nvd.nist.gov). Ratings follow the IDRS v1 (North American academic) grade calculator; the grade is computed automatically from the CRIS scores entered above.
