Vorwerk Kobold Robot Vacuum Cleaner (VR300)

Vorwerk Kobold Robot Vacuum Cleaner (VR300)
Security Grade D Calculator v	Vorwerk Kobold VR300 Robot Vacuum Cleaner Brand: Vorwerk (Parent: Vorwerk) Category: Robot vacuum cleaner • Model / Gen: Kobold VR300 Release Date: 2018-10-22 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	Exposed serial access enabled a secure-boot bypass in the assessed firmware. Evidence boundary: Qualitative resistance mapping; no incident-frequency measurement.
Known vulnerabilities	Rare	🔗 Proof	The historical build had weak key generation and shared credentials; patches followed. Evidence boundary: Historical assessment; do not transfer this exposure to current firmware.
Prior attacks	None	🔗 Proof	No exact-model botnet or in-the-wild campaign was identified in this bounded search; laboratory demonstrations are not counted. Evidence boundary: No exact-model field campaign established in the reviewed material through 24 October 2026; published laboratory exploits are not counted as observed campaigns.
Updatability	Very common	🔗 Proof	Repeated vendor fixes and an official multi-release history support frequent maintenance, with OTA and manual update paths. Evidence boundary: Later releases through 4.6.4 are distinguished from the historical vulnerable build; a support-page update timestamp is not a release date. Additional primary evidence: source 2.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Command authentication exists, but shared credentials permit device impersonation.
Communications	No encryption	🔗 Proof	Local manual-drive commands and authentication material are plaintext despite separate cloud TLS. Evidence boundary: Mixed paths: the weakest enabled command path determines the category. Additional primary evidence: source 2.
Storage	Encrypted with obselete encryption	🔗 Proof	Flash-resident blackbox/core files use obsolete RC4 and a common recoverable key. Evidence boundary: The evidenced objects are stored logs/cores, not every partition.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	The manual documents cloud-account linking and device ownership. Evidence boundary: Full local role-based account lifecycle evidence is absent; basic cloud linking is the evidenced boundary. Additional primary evidence: source 2.
Authentication	Basic	🔗 Proof	Shared credentials and bypassable boot checks weaken the assessed authentication.
Brute-force protection	Basic	🔗 Proof	Cloud blacklisting restricts online guessing; predictable secrets still permit offline search. Evidence boundary: This measures the effective device-credential attack path, not an independently tested cloud-password policy.
Event logging	Partial logging	🔗 Proof	Diagnostic logs and cleaning summaries exist; full access auditing is unproven. Evidence boundary: Diagnostic logs are not equated with a full access audit trail. Additional primary evidence: source 2.
Passwords	Default/Common/Easy to guess	🔗 Proof	The robot-control credential is derived from predictable state. Evidence boundary: Device-control credential, not the customer's cloud-account password.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	(Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

Assessment scope

Historical documentary case study of stock Kobold VR300 firmware 4.2.5-166 (build dated 11 January 2019), including its normal local manual-driving, cloud and app control paths. Findings are bounded to that researched build and shared ecosystem components explicitly applicable to VR300. No physical test is claimed. Later releases and current support are described separately.

Method and evidence boundaries

This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.

Calculated IDRS: 2 + 3 + 3 = 8 (D).

Date basis: French retailer Pieces Detachees Elec explicitly dates its original VR300 catalogue entry Monday 22 October 2018. This day is the documented regional catalogue-listing date, not a manufacturer-confirmed global first-sale day. The manufacturer annual report confirms availability since October 2018 only: https://www.vorwerk-group.com/de/presse/publikationen/Vorwerk-Annual-Report-2018.pdf . Date source: https://www.piecesdetacheeselec.com/appareils-neufs-vorwerk/26469-robot-kobold-vr300-vorwerk.html

Patch/support context: The WOOT19 researchers report vendor fixes rolled out through June 2019. Official UK support lists later releases through 4.6.4 and OTA/manual procedures; its April 2025 page update is not treated as the firmware release day. No current-firmware retest is claimed.

Product-specific boundaries: The grade describes the historical 4.2.5-166 deployment, not current 4.6.4 security. The precise form day records a named French retailer catalogue entry; only the launch month is manufacturer-confirmed. Passwords 3 concerns the documented predictable device-control secret, not every owner-selected cloud password. Storage 2 concerns flash-resident RC4-protected diagnostic logs/cores, not a claim that all flash partitions have the same protection.