| Samsung SmartThings Hub v2 (STH-ETH-200)
|
|
Security Grade
Calculator v
|
Samsung SmartThings Hub v2
Release Date: 2015-04-01 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Teardown and hardware modification are feasible, but large-scale tampering is rare
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Multiple vulnerabilities including insecure local API and credential exposure
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Research exploits exist, mass real-world attacks are uncommon
|
| Updatability
|
Rare
|
🔗 Proof
|
End of life, Samsung no longer provides new security firmware updates
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Integrates fully with SmartThings cloud and Samsung ecosystem
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Early firmware uses outdated TLS versions and weak encryption for local traffic
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
Stored device credentials use old encryption algorithms
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Complete account and device management inside SmartThings app
|
| Authentication
|
Basic
|
🔗 Proof
|
Basic password authentication, 2FA support was not available on this old hub
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
No native rate limiting to block brute force login attempts
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Basic device state events logged, fine-grained access audit logs are missing
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
Cloud account enforces password complexity rules
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
SmartThings proprietary firmware (Companion App: SmartThings)
|
| Hardware (CPU / GPU)
|
CPU: Not publicly disclosed • GPU: Not publicly disclosed
|
| Memory & Storage
|
Memory: Not publicly disclosed • Storage: Not publicly disclosed
|
| Power, Battery & Charging
|
Battery: None • Power: DC 5 V power adapter • Charging: Not applicable
|
| Display & Camera
|
Display: None • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: Wi‑Fi 2.4 GHz, Ethernet, Zigbee, Z-Wave
|
| Physical (Dimensions & Mass)
|
Dimensions: 130 × 130 × 28 mm • Mass: 190 g
|
This is an EOL smart home hub supporting Zigbee and Z-Wave. It contains multiple known vulnerabilities. It uses obsolete encryption for local communications and stored credentials, without brute force protection.
