| Home Assistant Green (NC-GREEN-1175)
|
|
Security Grade
Calculator v
|
Home Assistant Green
Category: Smart home hub • Model / Gen: Original Green model; no numbered generation advertised NC-GREEN-1175
Release Date: 2023-09-17 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[[1] 🔗 Proof]
|
Qualitative physical-access assessment: the accessible reset button permits wiping the data disk and returning Green to onboarding; USB and microSD recovery interfaces are also exposed. An attacker with physical access can disrupt or replace the configuration. Rare reflects the physical-access prerequisite, not measured incident prevalence or demonstrated tamper resistance.
|
| Known vulnerabilities
|
Rare
|
[[2] 🔗 Proof]
|
Isolated documented example: Music Assistant <=2.6.3, when installed as an optional Green add-on, allowed unauthenticated adjacent-network code execution; fixed in 2.7.0. This is not a stock-hardware flaw or a claim that a fully updated Green remains vulnerable.
|
| Prior attacks
|
Rare
|
[[3] 🔗 Proof]
|
Compass Security describes a successful Pwn2Own 2025 research demonstration against Green with the Music Assistant add-on, escalating to host access. Rare denotes a published demonstration here; no prevalence of malicious deployments or attacks is asserted.
|
| Updatability
|
Very common
|
[[4] 🔗 Proof]
|
The manufacturer documents monthly Home Assistant improvements. Software updates remain the owner's responsibility.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[[5] 🔗 Proof]
|
Most API requests require a token, while webhooks and intentionally public endpoints are exceptions. Authentication of third-party integrations varies; universal mutual authentication is not established.
|
| Communications
|
No encryption
|
[[6] 🔗 Proof]
|
Default local web access uses HTTP. TLS certificates and client-certificate requirements can be configured; Home Assistant Cloud provides a secure tunnel. This rating concerns the unhardened local interface, not every integration.
|
| Storage
|
No encryption
|
[[7] 🔗 Proof]
|
Source-based assessment of the standard data partition: HAOS 18.3 creates and directly mounts an ext4 hassos-data image for persistent application data without an encryption layer. Encrypted backups are a separate feature; no physical eMMC test was performed.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
[[8] 🔗 Proof]
|
User/admin/read-only roles exist, but the security policy explicitly trusts logged-in users and does not treat role separation as a security boundary.
|
| Authentication
|
Basic
|
[[9] 🔗 Proof]
|
Username/password and optional MFA protect normal login. The official Green recovery procedure permits a physical button reset that clears the data disk and returns to onboarding; physical access must be controlled.
|
| Brute-force protection
|
Exist
|
[[10] 🔗 Proof]
|
The software provides IP banning after a configured number of failed logins. This is a supported protection, not an assertion of factory enablement: configure ip_ban_enabled and a finite login_attempts_threshold for it to operate.
|
| Event logging
|
Partial logging
|
[[11] 🔗 Proof]
|
Failed logins are reported and bans recorded. A complete audit trail of all successful access and administration is not established.
|
| Passwords
|
Require change after setup
|
[[12] 🔗 Proof]
|
Closest available rubric option: onboarding requires creation of an owner username/password instead of using a shared factory password. Mandatory complexity rules were not established; this is initial creation, not a later forced rotation.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Home Assistant Operating System with Home Assistant (Companion App: Home Assistant web interface; Home Assistant Companion for iOS/Android)
|
| Hardware (CPU / GPU)
|
CPU: Rockchip RK3566; quad-core Arm Cortex-A55, 1.8 GHz • GPU: Integrated Arm Mali-G52 in the RK3566; HDMI is for diagnostics on Green
|
| Memory & Storage
|
Memory: 4 GB LPDDR4X • Storage: 32 GB eMMC; microSD recovery slot
|
| Power, Battery & Charging
|
Battery: Optional CR2032 for clock backup; not supplied • Power: 12 V DC, 1 A barrel connector; approximately 1.7 W idle / 3 W load • Charging: Not applicable; mains-powered hub
|
| Display & Camera
|
Display: No integrated display; diagnostic HDMI output • Camera: No integrated camera listed
|
| Sound & Connectivity
|
Sound: No integrated speaker or microphone listed • Connectivity: Gigabit Ethernet; 2 USB 2.0 host ports. Zigbee, Thread, Z-Wave and Bluetooth require appropriate external adapters.
|
| Physical (Dimensions & Mass)
|
Dimensions: 112 x 112 x 32 mm • Mass: 340 g
|
Desk research dated 2026-10-23; no physical tests or cybersecurity certification. Green runs official Home Assistant software. Standard local HTTP and ordinary account login are assessed; TLS, MFA and IP bans require appropriate configuration. The brute-force selection denotes available configurable protection, not a tested enabled setting. Historical exploit evidence concerns Green with the optional Music Assistant add-on, not an unconditional stock-device flaw. Date is the 2023-09-17 announcement/limited release. Incident labels describe published evidence rather than measured population rates; None means no qualifying incident identified in the stated search, not zero risk.
Physical tampering is an assessor rating of accessible reset/reflash interfaces and the physical-access requirement; it is not an incident-frequency statistic.
Release-date scope: Official announcement and limited anniversary release; wider distributor availability followed in November 2023.
Product status: In sale. Current manufacturer product page offers Home Assistant Green.
Proposed IDRS calculation under the assessment scope above: Device 2, System 3, User Authentication 2, total 7, grade C. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.
Firmware scope: Official Home Assistant OS; storage source checked at OS 18.3. Default local HTTP and ordinary owner-account login assessed. IP-ban capability is explicitly configurable. Historical Music Assistant incident applies only when that optional add-on was installed.
Additional references:
