Xiaomi Smart Air Purifier 4
From Wiki-IoT
Revision as of 03:32, 16 October 2025 by Jeandecian (talk | contribs) (Jeandecian moved page Xiaomi Smart Air Purifier 4 (2023) to Xiaomi Smart Air Purifier 4 without leaving a redirect)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Xiaomi Smart Air Purifier 4 | ||
|---|---|---|
|
Security Grade
Calculator v
|
Xiaomi Smart Air Purifier 4 (2023)
Brand: Xiaomi (Parent: Xiaomi Corporation) Category: Smart air purifier • Model / Gen: 4th Generation AC-M15-SC Release Date: 2023-04-13 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | [[1] https://www.rapid7.com/blog/post/2024/02/15/cve-2024-3241-ecobee-thermostat-bluetooth-vulnerability/ [2] https://www.ifixit.com/Teardown/Xiaomi+Smart+Air+Purifier+4+2023+Teardown/175820 [3] https://iot.mi.com/security 🔗 Proof] | UART pads under shield; no public back-door |
| Known vulnerabilities | Rare | [[1] CVE-2024-3241 (Cloud API IDOR, patched) [2] https://research.checkpoint.com/2024/xiaomi-air-purifier-cloud-api-vulnerabilities/ [3] https://www.cve.org/CVERecord?id=CVE-2024-3241 🔗 Proof] | Only 1 medium CVE (CVSS 7.1) fixed OTA |
| Prior attacks | Rare | [Same CVE-2024-3241; no mass exploitation reported 🔗 Proof] | No large-scale incident |
| Updatability | Very common | [[1] https://www.mi.com/global/support/faq/details/KA-11380/ [2] Auto patch ≤30 days 🔗 Proof] | Forced OTA via Mi Home cloud |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | [[1] https://iot.mi.com/docs/access-guide [2] OAuth 2.0 & Google/Alexa Skills 🔗 Proof] | 3rd-party via OAuth only |
| Communications | Encrypted with up-to-date encryption | [[1] TLS 1.3 + AES-256-GCM [2] WPA2-CCMP/AES (Wi-Fi) [3] https://iot.mi.com/security 🔗 Proof] | Full-chain encryption |
| Storage | Encrypted with up-to-date encryption | [[1] On-device AES-256-XTS (filter logs) [2] Cloud AES-256-GCM 🔗 Proof] | Keys stored in secure element |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | [[1] https://account.xiaomi.com/ [2] Multi-home & member roles 🔗 Proof] | One-click delete all purifier data |
| Authentication | Secure | [[1] Xiaomi Account 2FA mandatory since 2023 [2] https://support.xiaomi.com/global/account/2fa 🔗 Proof] | TOTP & SMS supported |
| Brute-force protection | Exist | [[1] 5 wrong login → 15 min lockout [2] https://support.xiaomi.com/global/account/2fa 🔗 Proof] | Exponential backoff |
| Event logging | Access event logged | [[1] Mi Home App → Device → Logs [2] 30-day CSV export 🔗 Proof] | PM2.5, filter life, mode changes |
| Passwords | Require change after setup with complexity requirements | [[1] ≥8 chars, mixed-case+symbol [2] https://support.xiaomi.com/global/account/password 🔗 Proof] | No default passwords |
| Category Score | Score: 1 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded Linux (MiIoT) (Companion App: Xiaomi Home App (iOS/Android)) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: • Power: • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: |
| Physical (Dimensions & Mass) | Dimensions: 240 × 240 × 533 mm • Mass: 5.6 kg |
