De'Longhi PrimaDonna Soul (ECAM610.75.GB)

De'Longhi PrimaDonna Soul (ECAM610.75.GB)
Security Grade D Calculator v	De'Longhi PrimaDonna Soul Brand: De'Longhi (Parent: De'Longhi S.p.A.) Category: Smart Appliance • Model / Gen: ECAM610.75.GB Release Date: 2021-09-10 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—
Known vulnerabilities	Rare	🔗 Proof
Prior attacks	Rare	🔗 Proof
Updatability	None	—
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—
Communications	Encrypted with obselete encryption	—
Storage	No encryption	—
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—
Authentication	Basic	🔗 Proof
Brute-force protection	Absent	—
Event logging	Partial logging	—
Passwords	Default/Common/Easy to guess	—
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	De'Longhi IoT OS (Linux based) (Companion App: )
Hardware (CPU / GPU)	CPU: ARM Cortex-A5 • GPU: None
Memory & Storage	Memory: 256 MB RAM • Storage: 2 GB eMMC
Power, Battery & Charging	Battery: None • Power: 220V AC, 1450W • Charging:
Display & Camera	Display: 3.5 inch TFT touchscreen • Camera: None
Sound & Connectivity	Sound: None • Connectivity: 2.4GHz Wi-Fi, Bluetooth
Physical (Dimensions & Mass)	Dimensions: • Mass:

CVE-2022-46640 is an OS command injection vulnerability in the De'Longhi PrimaDonna connected coffee machines (CVSS 9.8, Critical). An attacker on the local network can send a crafted request to the machine's web server and execute arbitrary operating system commands with root privileges. Because the device has no firmware update mechanism, the flaw cannot be patched by the user. A compromised coffee machine can be used as a low-power, always-on device inside the home LAN, which makes it a convenient pivot point for further attacks.