northwind-hub-2-v4.2.1.bin
A critical hole in the update path, and a long tail of old parts.
214 parts found. Eleven are flagged: one critical, three high, four medium, two low and one note. The device installs an update from any source it can download from, and the encryption library stopped getting public patches in 2023.
Highest risks
- Critical
Updates are installed without checking who made them
The update path downloads a file and installs it. The app found no signature check between download and install.
Suggested change: Sign every update with a key kept offline, ship the public key on the device, and refuse any update whose signature does not match.
- High
The encryption library gets no more public patches
OpenSSL 1.1.1 reached its end of life in September 2023. New vulnerabilities in it get no public patch.
Suggested change: Move to OpenSSL 3.0 or later, and note the change in your release notes.
- High
The companion app is signed with a debug certificate
The Android app in the firmware package uses a debug signing key, which anyone can copy.
Suggested change: Sign release builds with your own release key and keep that key off the build server.
Parts list
10 of 214 parts shown
| Part | Version | Status |
|---|---|---|
| OpenSSL | 1.1.1w | High risk |
| Linux kernel | 5.10.110 | Update |
| BusyBox | 1.36.0 | Update |
| Dropbear SSH | 2022.83 | Update |
| curl | 7.88.1 | Fine |
| zlib | 1.2.11 | Update |
| uhttpd | 2021-05-21 | Update |
| Android companion app | 1.8.2 | High risk |
| AWS IoT device SDK | 1.5.0 | Update |
| WPA supplicant | 2.9 | Update |
Annex I map
Each of the 22 points of Annex I gets a state, with the reason. Here are four of them.
- Part I (2)(a)
- No known exploitable vulnerabilities
- Partial
- Known bugs found in 4 parts. Finding nothing is never proof, so this point can only be partial.
- Part I (2)(c)
- Security updates
- Partial
- An update path exists, but updates are not signed.
- Part II (1)
- Parts list and vulnerabilities
- Evidenced
- Parts list made from the file, in CycloneDX and SPDX.
- Part II (5)
- Disclosure policy
- Open
- A file cannot show this. The pack has a template.
In the document pack
- Parts list: CycloneDX 1.5 and SPDX 2.3
- Technical file index for Annex VII, with what you must still add
- Support-period record
- Reporting guide for Article 14
- Declaration of conformity checklist
- Vulnerability handling and update policy templates
Technical evidence, not a legal certificate.