| UbiBot AQS1 Smart Air Quality Monitor
|
|
Security Grade
Calculator v
|
UbiBot AQS1 Smart Air Quality Monitor
Release Date: 2023-11-18 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
The AQS1 has a physical enclosure and external interfaces. Physical manipulation is possible, but no model-specific tampering incident has been established.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No AQS1-WiFi-specific vulnerability was established from the reviewed documentation. This is not proof that the device has no vulnerabilities.
|
| Prior attacks
|
None
|
🔗 Proof
|
No confirmed attack targeting the AQS1-WiFi was established in the reviewed materials.
|
| Updatability
|
Very common
|
🔗 Proof
|
UbiBot provides firmware update instructions for supported devices. Model-specific firmware update availability should be confirmed.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The UbiBot platform supports API keys for integration, but the AQS1 device-to-cloud authentication mechanism is not fully documented.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
The AQS1 supports WEP, WPA and WPA2 Wi-Fi configurations. WEP is obsolete; this rating reflects the weakest supported configuration rather than verified actual usage.
|
| Storage
|
No encryption
|
🔗 Proof
|
The AQS1 can store up to 300,000 sensor records locally. Encryption at rest has not been established in the reviewed documentation.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
The UbiBot platform supports user accounts and account security management, including optional two-factor authentication.
|
| Authentication
|
Secure
|
🔗 Proof
|
The UbiBot platform offers authenticator-based two-factor authentication, although enabling it is optional.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
The platform documents API access controls, but login-specific lockout and brute-force protection have not been verified.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The platform provides device records and API-related logs, but complete security audit logging has not been established.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The reviewed sources do not establish the device's initial password policy or mandatory password changes. This is a forced-choice assumption, not evidence of weak default credentials.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (Companion App: UbiBot App)
|
| Hardware (CPU / GPU)
|
CPU: Not publicly specified • GPU: None specified
|
| Memory & Storage
|
Memory: Not publicly specified • Storage: 300,000 sensing records
|
| Power, Battery & Charging
|
Battery: No built-in battery specified • Power: USB-C 5V/2A or DC 12V • Charging: Not applicable
|
| Display & Camera
|
Display: No display specified • Camera: None
|
| Sound & Connectivity
|
Sound: No speaker specified • Connectivity: 2.4 GHz Wi-Fi (802.11 b/g/n), RS485
|
| Physical (Dimensions & Mass)
|
Dimensions: 128 × 128 × 40 mm • Mass: 188 g
|
The UbiBot AQS1-WiFi is an IoT air quality monitoring device that measures temperature, humidity, atmospheric pressure, particulate matter (PM1.0, PM2.5 and PM10), TVOC and carbon dioxide.
It supports 2.4 GHz Wi-Fi connectivity, RS485 communication, local storage of up to 300,000 sensor records and integration with the UbiBot cloud platform.
The device supports several Wi-Fi security modes, including WEP, WPA and WPA2. The UbiBot cloud platform also provides account management and optional two-factor authentication.
However, the available public documentation does not fully establish device-level encryption at rest, login brute-force protection, initial password policies or comprehensive security audit logging.
Several assessment values are provisional because public documentation is insufficient to establish the underlying security property. These assumptions should not be treated as confirmed vulnerabilities.
Sources:
https://www.ubibot.com/ubibot-aqs1/
https://www.ubibot.com/ubibot-aqs1-specifications/
https://www.ubibot.com/manuals/6266/ubibot-aqs1-user-guide/
