Gosund SP111 Smart Plug (SP111)

Gosund SP111 Smart Plug (SP111)
Security Grade B Calculator vv1	Gosund SP111 Smart Plug Brand: Gosund (Parent: Gosund (Shenzhen Ghome Smart Technology)) Category: Smart plug • Model / Gen: SP111 SP111 Release Date: 2020-01-01 • Status: In sale Classification Date: 2026-10-24 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	🔗 Proof	Peer-reviewed testing found the reprogramming interface trivially discoverable and uploading modified firmware straightforward; a large enthusiast community documents disassembly and Tasmota flashing of this model.
Known vulnerabilities	Rare	🔗 Proof	No CVE record matching Gosund was found in the NVD. However, the absence of CVEs reflects a lack of coordinated reporting rather than proven security: peer-reviewed research demonstrates a full compromise path on this model.
Prior attacks	None	🔗 Proof	No public report of botnet recruitment or in-the-wild exploitation targeting Gosund plugs was found; the Tuya ecosystem raises supply-chain concerns, but no confirmed attack on this model exists.
Updatability	Very common	🔗 Proof	The device downloads code from the manufacturer's server automatically upon connecting to the internet, even without user confirmation. Updates are delivered, although without user control or documented release notes.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The device authorization key and identifiers are stored in flash in plain JSON structures, and the researchers note these structures may serve as a backup access path to the device.
Communications	Encrypted with obselete encryption	🔗 Proof	Cloud traffic is MQTT over an encrypted channel, but Wi-Fi credentials are handed over during the Tuya pairing process and the unauthenticated local reprogramming path undermines the transport guarantees.
Storage	Encrypted with obselete encryption	🔗 Proof	The authorization key, device identifiers and backup SSID/password structures were found in flash as plain JSON, readable through the UART interface; no encryption at rest is documented.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Tuya/Gosund cloud account with multi-user device sharing; no documented role separation or permission granularity.
Authentication	Basic	🔗 Proof	Control depends on the Tuya cloud account, and no two-factor authentication is offered; the local reprogramming path demonstrated in research bypasses account authentication entirely.
Brute-force protection	Basic	🔗 Proof	No failed-attempt throttling or lockout is documented for the app or cloud API, and the local firmware path does not enforce credentials at all.
Event logging	Partial logging	🔗 Proof	The UART interface emits service messages and the app shows basic status and energy history, but no security-grade audit log is documented.
Passwords	Require change after setup	🔗 Proof	Access depends on the Tuya/Gosund cloud account created during setup; no enforced complexity policy is documented.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded firmware (ESP8266, Tuya) (Companion App: Smart Life (Tuya) / Gosund)
Hardware (CPU / GPU)	CPU: ESP8266 • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: 230 V AC, 50 Hz, 16 A max, 3680 W • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 802.11 b/g/n, 2.4 GHz (Tuya cloud, MQTT)
Physical (Dimensions & Mass)	Dimensions: 79 x 48 x 46 mm • Mass: approx. 18.1 g

Overall assessment: The SP111 illustrates that the absence of CVEs does not equal security. Peer-reviewed research (MDPI Electronics, 2024) demonstrated a complete compromise path: the UART reprogramming interface is trivially discoverable, modified firmware can be uploaded without authentication, and such firmware can exfiltrate the Wi-Fi SSID and password to an external command-and-control server. The device authorization key and backup network structures are stored in flash as plain JSON with no encryption at rest. Updates are downloaded automatically from the vendor server without user confirmation, which shows an active update channel but no user control. No botnet recruitment or in-the-wild exploitation of this model has been reported, and no CVE is recorded against the brand, so the classification rests primarily on documented weaknesses rather than observed attacks.