Eufy Security Smart Lock Touch (S230)

Eufy Security Smart Lock Touch (S230)
Security Grade B Calculator v	eufy Security Smart Lock Touch & Wi-Fi (model T8520, S230) Brand: eufy Security (Anker) Category: Smart lock / electronic deadbolt • Model / Gen: S230 T8520 Release Date: 2021-02-07 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	Zinc alloy and stainless steel deadbolt with BHMA grade rating; no public teardown or tampering CVE specific to T8520 is on record. Physical attack surface exists but is bounded by the mechanical deadbolt and IP65 housing.
Known vulnerabilities	Rare	[2] 🔗 Proof	No T8520-specific CVE is on record. Platform-level eufy CVEs: CVE-2021-3555 (RTSP buffer overflow on eufy Indoor Cam 2K, firmware 2.0.9.3 and prior) and CVE-2022-21806 (use-after-free on eufy HomeBase 2 firmware 2.1.8.5h). These are camera/HomeBase research findings, not model-specific to T8520, and do not imply current lock firmware is vulnerable.
Prior attacks	Rare	🔗 Proof	Public security coverage concerns eufy camera/HomeBase research (Bitdefender 2021 RTSP/MitM firmware update report); no mass in-the-wild botnet or campaign is attributed to eufy smart locks. Prior attacks is platform-level history.
Updatability	Very common	🔗 Proof	The lock connects directly to 2.4 GHz Wi-Fi and firmware updates are delivered over-the-air through the eufy Security app while the device is online; eufy has continued to ship security fixes for its smart lock line after disclosure events.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[3] 🔗 Proof	The lock is bound to a single eufy Security cloud account during app setup and talks to the eufy cloud; it does not require an eufy HomeBase and this model does not declare native HomeKit/Matter/third-party hub pairing. The assessed profile therefore has account-channel authentication but no additional per-device mutual cryptographic authentication to third-party platforms.
Communications	Encrypted with up-to-date encryption	🔗 Proof	The assessed profile uses the default eufy Security app-to-cloud channel over HTTPS/TLS; BLE is used only during initial pairing. No public documentation identifies a WEP/TLS 1.0-era weak cipher as the live transport, so the channel is rated Encrypted with up-to-date encryption.
Storage	No encryption	🔗 Proof	eufy markets that fingerprint templates are stored locally on the lock for privacy, but eufy does not publish a per-partition flash encryption claim (e.g. AES-XTS on the NAND/eMMC) for T8520. Per WikiIoT rule, an undocumented local-flash encryption state is rated No encryption rather than assumed encrypted.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	The eufy Security app supports adding multiple user PIN codes, temporary/guest codes, scheduled access, event history review and remote device removal; these map to Full account management.
Authentication	Basic	🔗 Proof	Access to the lock and its cloud history is via eufy account sign-in in the eufy Security app; the assessed profile does not enable optional 2-Step Verification on the eufy/Anker account, so cloud authentication is rated Basic rather than Secure.
Brute-force protection	Exist	🔗 Proof	The physical keypad/fingerprint sensor enters a temporary lockout after repeated failed attempts (anti-peep code and wrong-attempt lockout are documented features); cloud-side sign-in throttling is provided by the eufy account channel. The assessed profile does not enable optional 2FA, but device-side brute-force protection exists.
Event logging	Access event logged	🔗 Proof	The eufy Security app records lock/unlock events with timestamps, including which user code or fingerprint triggered the event; users can review the history in the app.
Passwords	Require change after setup with complexity requirements	🔗 Proof	Setup requires signing into an existing eufy Security account or creating a new one under eufy/Anker password complexity policy; the lock itself has no hard-coded default password. User PIN codes are then enrolled by the owner in the app.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	eufy Security embedded firmware; assessment: current firmware as of 2026-10-24 (Companion App: eufy Security app (Android/iOS))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: Built-in rechargeable 10,000 mAh battery (USB-C charging) • Power: Battery-powered (10,000 mAh rechargeable); USB-C charging port • Charging: USB-C charging port (external); low-battery alert in app
Display & Camera	Display: Backlit touchscreen keypad • Camera:
Sound & Connectivity	Sound: Built-in speaker for beeps and voice feedback • Connectivity: Built-in 2.4 GHz Wi-Fi (802.11 b/g/n); Bluetooth (for setup and local app control)
Physical (Dimensions & Mass)	Dimensions: 6.26 x 2.83 x 1.03 in (159 x 72 x 26 mm) • Mass: 3.1 lb (1.4 kg)

Documentation-based security assessment: eufy Security Smart Lock Touch & Wi-Fi (model T8520, S230). Reviewed 2026-10-24.

Documentation-based assessment of a defined eufy Security profile. The lock is set up through the eufy Security app on iOS/Android and bound to a single eufy cloud account; the account uses a password under eufy/Anker complexity policy but optional 2-Step Verification is not enabled in this profile. The default app-to-cloud HTTPS/TLS channel is used; BLE is used only during initial pairing. The lock does not require an eufy HomeBase and this model does not declare native HomeKit/Matter pairing. The built-in rechargeable 10,000 mAh battery powers the device; firmware updates are delivered OTA while the lock is online. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.

Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform-level history; the cited CVEs concern eufy Indoor Cam 2K and eufy HomeBase 2 research, not a confirmed victim record for model T8520, and do not cover the smart lock firmware directly. Optional capabilities (e.g. 2FA, third-party HomeKit pairing) are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected current firmware remains vulnerable.

Release-date scope: 2021-02-07, the date stated in the body of the official eufy Community launch announcement; Best Buy first retail was 2021-02-14. Not asserted to be the earliest worldwide retail date.

Historical vulnerability: CVE-2021-3555 (pre-authentication buffer overflow in the RTSP server on eufy Indoor Cam 2K, firmware 2.0.9.3 and prior; the vulnerable RTSP method is disabled by default). CVE-2022-21806 (use-after-free in mips_collector appsrv_server on eufy HomeBase 2 firmware 2.1.8.5h, remote code execution). Both are eufy camera/HomeBase platform-level research findings disclosed by Bitdefender/Talos, not model-specific CVEs for T8520; eufy has shipped mitigations and automatic updates for the affected platforms.

No physical device was tested. Keep the configuration and evidence scope with the ratings.

References: eufy US — Smart Lock S230 (T8520) product page eufy Community — Smart Lock Touch Now with Wi-Fi, 2021-02-07 eufy Support — Introducing eufy Smart Lock Touch & Wi-Fi eufy Support — T8520 uses 10,000 mAh rechargeable battery Newegg — eufy T8520 retail spec sheet eufy AU — eufy Wi-Fi smart lock line NVD — CVE-2021-3555 eufy Indoor Cam 2K RTSP buffer overflow OpenCVE — CVE-2022-21806 eufy HomeBase 2 use-after-free Bitdefender — Vulnerabilities in eufy 2K Indoor Camera WikiIoT methodology