Internal Pentest
Penetration Testing Report – Dragino LHT65S Sensor
Device Tested: Dragino LHT65S LoRaWAN Temperature & Humidity Sensor
Test Date: 20/10/2024
Tested By: MFC Safe
Executive Summary
This report outlines the penetration testing results for the Dragino LHT65S sensor, focusing on physical access, firmware integrity, wireless security, and overall device resilience. The sensor demonstrated a strong security profile for a low-power LoRaWAN device, with no high-risk vulnerabilities identified.
Physical Access Ports
UART port exposed without protection
Low
Firmware Security
Flash memory protected, no read access
Low
Wireless Communication
AES-128 encryption validated
Low
Device Authentication
No exposed login interfaces
Low
OTA Updates
Manual update only, no remote override
Low
Known Vulnerabilities
None applicable to LHT65S
Low
Data Integrity & Replay
Retransmission and validation passed
Low
Test Details & Findings
1. Physical Port Security
Finding: UART debug pins are exposed on the board.
Impact: Enables potential local manipulation if physical access is gained.
Recommendation: Restrction of entry to premisis, epoxy or mask headers in production deployments.
Risk: Low
2. Firmware Protection
Finding: Memory is encrypted and read-protected.
Result: Firmware dumping attempts failed.
Risk: Low
3. LoRaWAN Security
Finding: Communication uses LoRaWAN AES-128 encryption.
Result: Payloads could not be interpreted without NwkSKey/AppSKey.
Risk: Low
4. Authentication Exposure
Finding: Device does not expose a user-facing login or web portal.
Result: No brute-force or bypass attacks applicable.
Risk: Low
5. OTA Firmware
Finding: No over-the-air update mechanism is available.
Impact: Firmware must be physically flashed, reducing remote attack surface.
Risk: Low
6. Known Vulnerabilities
Finding: No CVEs found that apply to LHT65S model.
Risk: Low
7. Data Integrity and Replay Protection
Finding: Data transmission follows confirmed uplinks with retries.
Result: Transmission retry logic prevents data loss.
Risk: Low
Recommendations
Secure physical access to sensors with tamper-evident enclosures.
Mask or epoxy UART ports where unused.
Maintain firmware currency via Dragino updates and notices.
Conclusion
The Dragino LHT65S sensor passed all critical and major security tests with no exploitable high-risk vulnerabilities. Its physical security could be improved, but wireless communications, firmware protection, and operational design are suitable for deployment in secure environments.
This report is intended for internal compliance and client submission purposes.
Last updated
Was this helpful?