Tado Smart Thermostat 3rd gen wired (RU02)
From Wiki-IoT
Revision as of 14:58, 25 October 2026 by TJUTZT (talk | contribs) (Student assignment submission for IoT security assessment)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Tado Smart Thermostat 3rd gen wired (RU02) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
tado Smart Thermostat (3rd gen wired)
Category: Smart Thermostat • Model / Gen: V3+ (3rd generation) RU02 (ST01); Internet Bridge IB01 Release Date: 2018-09-01 • Status: In sale Classification Date: 2026-10-25 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=tado 🔗 Proof | No public hardware-tampering or firmware-extraction attack against the RU02 was found. tado runs a vulnerability disclosure policy and NVD lists no tado hardware CVE. |
| Known vulnerabilities | None | https://www.tado.com/en-gb/legal/information-security 🔗 Proof | NVD keyword search returns zero CVEs for tado and no device-specific advisory was found. This reflects public records only, so residual risk cannot be excluded. |
| Prior attacks | None | https://www.tado.com/en-gb/legal/information-security 🔗 Proof | No tado product appears in CISA KEV, and no public in-the-wild campaign against tado thermostats was found. |
| Updatability | Very common | https://www.tado.com/gb-en/wired-smart-thermostat 🔗 Proof | Devices connected to tado servers automatically download and install the latest firmware without user action. The installed version can be checked in the app under Rooms and Devices. |
| Category Score | Score: 1 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | https://uk.shop.tado.com/products/tado-wired-smart-thermostat-starter-kit-v3-intelligent-heating-control 🔗 Proof | Works with Apple HomeKit, Alexa, Google Assistant and Siri through tado account or HomeKit pairing. No open local API for third-party systems is documented. |
| Communications | Encrypted with up-to-date encryption | https://www.tado.com/en-gb/legal/information-security 🔗 Proof | The official key-information sheet lists TLS 1.2 with a 2048-bit EV certificate, 256-bit elliptic-curve encryption and AES-CCM for the 868 MHz device mesh. |
| Storage | Encrypted with up-to-date encryption | https://uk.shop.tado.com/products/tado-wired-smart-thermostat-starter-kit-v3-intelligent-heating-control 🔗 Proof | tado documents encrypted data handling with TLS and AES-CCM, but does not publish how schedules and configuration are stored at rest on the thermostat. This is partly inferred. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | https://help.tado.com/en/articles/4190245-how-can-i-get-started-with-the-tado-app 🔗 Proof | The account supports profile editing, multiple people per Home, removal of users and mobile devices, and full account deletion. No MFA or 2FA option is documented. |
| Authentication | Basic | https://www.tado.com/en-gb/legal/information-security 🔗 Proof | Login is by email and password in the tado app. No two-factor or hardware-token option is documented, so authentication is single-factor. |
| Brute-force protection | Basic | 🔗 Proof | Only email-based password reset is documented. No account-lockout or rate-limit policy is published, so protection against password guessing is unverified and treated as basic. |
| Event logging | Absent | https://support.tado.com/en/collections/1979449-using-tado 🔗 Proof | The app shows heating and energy reports and lists people with access, but no login history or security-event audit log is documented for the account or thermostat. |
| Passwords | Require change after setup | https://support.tado.com/en/collections/1979449-using-tado 🔗 Proof | There is no default device password; the user sets the tado account password during app setup. Password complexity and rotation requirements are not published. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary embedded firmware (Companion App: tado app) |
| Hardware (CPU / GPU) | CPU: N/A • GPU: N/A |
| Memory & Storage | Memory: N/A • Storage: N/A |
| Power, Battery & Charging | Battery: 3 x AAA backup batteries (average about 2 years) • Power: 4.5 VDC (wired supply); Internet Bridge 5 V USB • Charging: N/A |
| Display & Camera | Display: LED matrix 32 x 20 mm (10 x 19 LEDs); 2 capacitive and 1 mechanical button • Camera: None |
| Sound & Connectivity | Sound: None • Connectivity: 868 MHz 6LoWPAN mesh to Internet Bridge; Bridge connects to the router via Ethernet |
| Physical (Dimensions & Mass) | Dimensions: 104 x 104 x 18 mm (thermostat); Internet Bridge 81 x 27 x 22 mm • Mass: 156 g (thermostat); Internet Bridge 30 g |
Student assignment submission for IoT security assessment.
