| AVM FRITZ!DECT 200 (DECT 200)
|
|
Security Grade
Calculator vv1
|
AVM FRITZ!DECT 200
Category: Smart plug • Model / Gen: DECT 200 DECT 200
Release Date: 2013-01-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Plug enclosure with no publicly documented service connector or debug interface; AVM publishes a dedicated security advisory page and states its products are not affected by the KadNa and Avrecon botnets.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
No CVE is recorded against the DECT 200 itself. The brand-level CVE-2014-8886 affects FRITZ!OS before 6.30, which runs on the FRITZ!Box gateway rather than on the DECT plug.
|
| Prior attacks
|
None
|
🔗 Proof
|
AVM states that no botnet malware is active on its products, and no attack report specifically targeting DECT smart plugs was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
FRITZ!OS receives frequent updates and DECT device firmware is updated through the FRITZ!Box, which remains supported for many years after release.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The device is bound to a specific FRITZ!Box over encrypted DECT and inherits its user administration, but the pairing and registration mechanism of DECT ULE devices is not documented in detail by the vendor.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Communication with the FRITZ!Box runs over encrypted DECT ULE and local management is offered over HTTPS; AVM also provides VPN for remote access instead of exposing ports.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No vendor documentation of encryption at rest for configuration and consumption data held on the plug.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
FRITZ!OS supports multiple user accounts with separate rights, including restricted Smart Home only users, so permissions can be separated per person.
|
| Authentication
|
Basic
|
🔗 Proof
|
Control depends on a FRITZ!Box login session; push service and MyFRITZ! access use separate credentials but no second factor is mandatory.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
FRITZ!OS reacts to repeated failed login attempts, but no formal lockout policy is published.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
FRITZ!OS keeps an event log covering system, login and Smart Home switching events.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Each FRITZ!Box ships with its own pre-printed password and FRITZ!OS evaluates password strength, but complexity is not strictly enforced.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded DECT ULE firmware (managed by FRITZ!OS) (Companion App: FRITZ!App Smart Home (iOS / Android))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: None • Power: 230 V AC, 50 Hz, up to 2300 W • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: DECT ULE (via a FRITZ!Box with Smart Home base station)
|
| Physical (Dimensions & Mass)
|
Dimensions: approx. 70 x 70 x 50 mm (excluding plug pins) • Mass: approx. 130 g
|
Overall assessment: The DECT 200 has no CVE of its own and the brand-level CVE-2014-8886 concerns FRITZ!OS on the FRITZ!Box gateway, not this plug. Its score comes largely from vendor security governance rather than the device itself: AVM publishes a dedicated security page and states that botnets such as KadNa and Avrecon are not active on its products, FRITZ!OS supports multiple accounts with separate rights including Smart Home only users, remote access is offered through VPN rather than exposed ports, and an event log covers login and switching activity. DECT ULE traffic to the FRITZ!Box is encrypted and firmware is maintained through the gateway for many years. The weaker points are undocumented encryption at rest on the plug, the absence of a mandatory second factor, and no formal brute-force lockout policy.
