Your light switch command travels from your phone to a server in China and back to the switch on your wall. A light switch. In China. Sonoff has no local-only mode in stock firmware. Every time you turn on a light, the Chinese cloud knows. You can flash Tasmota to fix this — but then you're the IT department for a light switch. eWeLink powers 30+ smart home brands including Sonoff. A security flaw in eWeLink can compromise all of them at once. Researchers found API authentication weaknesses that could let attackers control any device on the platform. Your Sonoff switch shares infrastructure with dozens of brands you've never heard of. One breach, millions of homes.
What they claim: Sonoff promotes affordable smart home automation for everyone
What we found: Sonoff devices connect through the eWeLink cloud platform hosted on servers in China. The eWeLink app requires account creation with email or phone, and all device commands route through Chinese cloud servers — even simple on/off commands for a light switch. While Sonoff devices can be flashed with open-source firmware (Tasmota) for local control, the stock firmware has no local-only mode.
What they claim: eWeLink privacy policy describes standard data collection practices
What we found: The eWeLink platform (used by Sonoff and 30+ other Chinese IoT brands) collects device usage patterns, schedules, location, and network information. Security researchers found eWeLink's API had authentication weaknesses that could allow attackers to control any device on the platform. The shared platform means a vulnerability in eWeLink affects not just Sonoff but dozens of brands simultaneously.