Meross MSH30Q
From Wiki-IoT
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Meross MSH30Q | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Meross MSH30Q
Brand: Meross Category: Smart Plug • Model / Gen: MSH30Q Release Date: 2021-01-01 • Status: In sale Classification Date: 2026-10-21 • [www.meross.com/ Official Website] | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | [jvndb.jvn.jp/ja/contents/2023/JVNDB-2023-025505.html 🔗 Proof] | No mass physical-tampering campaign documented. |
| Known vulnerabilities | Very common | [jvndb.jvn.jp/ja/contents/2023/JVNDB-2023-025505.html 🔗 Proof] | CVE-2023-46892 (CVSS 8.8): authentication bypass via capture-replay on MSH30Q firmware 4.5.23, allowing information disclosure, tampering and denial of service. Related Meross MSS110 issues include an unauthenticated admin.htm interface and a hidden telnet service with a blank admin password. |
| Prior attacks | Rare | [jvndb.jvn.jp/ja/contents/2023/JVNDB-2023-025505.html 🔗 Proof] | No known mass exploitation campaign reported. |
| Updatability | Very common | [www.meross.com/ 🔗 Proof] | Firmware updated OTA through the Meross app. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | [www.meross.com/ 🔗 Proof] | Cloud account plus Alexa/Google/HomeKit integrations. |
| Communications | Encrypted with obselete encryption | [jvndb.jvn.jp/ja/contents/2023/JVNDB-2023-025505.html 🔗 Proof] | Cloud traffic uses TLS but the capture-replay bypass weakens effective transport trust. |
| Storage | No encryption | [www.meross.com/ 🔗 Proof] | No documented at-rest encryption on the device. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | [www.meross.com/ 🔗 Proof] | Single cloud account with basic device binding. |
| Authentication | Basic | [jvndb.jvn.jp/ja/contents/2023/JVNDB-2023-025505.html 🔗 Proof] | Authentication can be bypassed by replaying captured requests (CVE-2023-46892). |
| Brute-force protection | Basic | [www.meross.com/ 🔗 Proof] | No documented lockout policy. |
| Event logging | Partial logging | [www.meross.com/ 🔗 Proof] | On/off history in app; authentication events not exposed as an audit trail. |
| Passwords | Require change after setup | [www.meross.com/ 🔗 Proof] | Account password set at registration; complexity enforcement minimal. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (Companion App: Meross App (eWeLink)) |
| Hardware (CPU / GPU) | CPU: ESP8266/ESP32 SoC • GPU: N/A |
| Memory & Storage | Memory: Not publicly specified • Storage: Not publicly specified |
| Power, Battery & Charging | Battery: N/A • Power: AC mains • Charging: N/A |
| Display & Camera | Display: N/A • Camera: N/A |
| Sound & Connectivity | Sound: N/A • Connectivity: Wi-Fi 2.4 GHz |
| Physical (Dimensions & Mass) | Dimensions: Not publicly specified • Mass: Not publicly specified |
