3 devices analyzed. Set your privacy comfort level to filter.
What we found
Nest Thermostat (2020): DGoogle says your Nest thermostat's microphone only listens after you say 'Hey Google.' But a maximum-severity security flaw (CVE-2023-48419) let attackers ne...
CVE-2023-48419 (CVSS 10.0): An attacker in WiFi proximity can spy on Google Nest devices without user interaction. The Google Assistant Privacy Class Action lawsuit alleges devices record when anything remotely similar to command words is uttered. Google itself admitted a software update caused Home speakers to record at all times, not just after the wake word. Two critical CVEs (CVE-2023-48419, CVE-2023-6339) with maximum severity scores demonstrate the 'only after wake word' claim is technically unreliable.
BRP069C4x WiFi Controller: CDaikin promises to fix security vulnerabilities in a reasonable timeframe.
Daikin Europe N.V. vulnerability disclosure policy states they will 'fix the vulnerability within a reasonable timeframe' and 'inform you of the fix'. CVE-2025-10127 (CVSS 9.8) is an authentication bypass allowing anyone to reset the device password to default 'Daikin/Daikin' credentials. CISA advisory ICSA-25-254-10 confirms Daikin will NOT release a patch. This directly contradicts their stated security commitment and demonstrates a pattern: CVE-2022-41653 (CVSS 9.8, hard-coded passwords) and CVE-2022-38355 (CVSS 7.5, improper access control) show recurring critical vulnerabilities in the Daikin HVAC ecosystem.
Ecobee Thermostat: CKnows when you're home, when you sleep, and your daily routine. Shares data with your energy company.
The ecobee app (v12.8) embeds 7 third-party trackers including Amplitude (behavioral analytics), Branch (deep linking/attribution), Google Analytics, Google Firebase Analytics, Google Tag Manager, Google CrashLytics, and Optimizely (A/B testing). These trackers transmit user behavioral data, app usage patterns, and device interaction data to third-party companies. The app also requests ACCESS_ADSERVICES_AD_ID and ACCESS_ADSERVICES_ATTRIBUTION permissions specifically for advertising tracking.