Repository navigation
Device Compatibility
This is a loosely maintained knowledge base about the firmware and devices that may or may not work with UnTuyaOS3. For discussion about an individual device, please see the discussions area.
Devices running TuyaOS V3 with SDK version >= 3.5 may potentially work with this exploit. Versions below (3.3-3.4) do not have the OTA feature available to exploit. Some early versions of 3.5 may also be missing the feature. The feature has also been removed from select newer SDKs, 3.11.13 being a known specific version, may have had the OTA ability removed.
There is now way to know if your device is running TuyaOS3 without serial access to the device, so there will be no easy way to determine it, especially for BK7231N and RTL8720CF, except by comparing to known firmware versions, though usually a firmware having a major version of 3 is a clue. All T1 (BK7238) devices are TuyaOS3 with SDK 3.8 or higher.
All Tuya T1 devices released have been SDK 3.8+, so all devices should be compatible up to SDK version 3.11.24, after which a potential gate was added.
An incomplete list of T1 devices expected to work:
| firmware version | SDK | Device Type | Device Model/info |
|---|---|---|---|
| 0.0.5 | 3.8.31 | oem_t1_irbox_mol_ty | IR Repeaters |
| 0.0.8 | 3.11.11 | oem_t1_slide_strip_ty | RGBIC Light Strips |
| 1.0.0 | 3.8.31 | oem_t1_plug | Plugs |
| 1.0.0 | 3.11.12 | oem_t1_slide_strip_ty | RGBIC Light Strips |
| 1.0.1 | 3.11.16 | t1_common_user_config_ir_ty | IR Repeaters or TuyaMCU devices with IR Remotes |
| 1.0.2 | 3.8.31 | oem_t1_plug | Plugs |
| 1.0.2 | 3.8.31 | oem_t1_irbox_mol_ty | IR Repeaters |
| 1.0.2 | 3.11.12 | oem_t1_slide_strip_ty | RGBIC Light Strips |
| 1.0.2 | 3.11.16 | oem_t1_cutout_self_switch | Circuit Breakers |
| 1.0.3 | 3.11.16 | oem_t1_cutout_self_switch | Circuit Breakers |
| 1.0.6 | 3.8.31 | oem_t1_light | Lights |
| 1.0.6 | 3.11.11 | oem_t1_slide_strip_ty | RGBIC Light Strips |
| 1.0.9 | 3.8.31 | oem_t1_light | Lights |
| 1.0.11 | 3.8.31 | oem_t1_light | Lights |
| 1.0.13 | 3.8.31 | oem_t1_light | Lights |
| 1.0.17 | 3.8.31 | oem_t1_light | Lights |
| 1.0.21 | 3.11.11 | oem_t1_light | Lights |
| 1.0.23 | 3.11.12 | oem_t1_light | Lights |
| 1.0.51 | 3.11.31 | oem_t1_light | Lights |
| 1.1.0 | 3.11.16 | oem_t1_cutout_self_switch | Circuit Breakers |
| 1.1.4 | 3.8.31 | oem_t1_switch | Switches & Relays |
| 1.1.4 | 3.8.31 | oem_t1_plug | Plugs |
| 1.1.6 | 3.8.31 | oem_t1_plug | Plugs |
| 1.1.9 | 3.8.31 | oem_t1_switch | Switches & Relays |
| 3.0.22 | 3.11.11 | t1_common_user_config_ty | TuyaMCU devices |
T1 devices that may be patched (if you verify they are unpatched, please move them to the table above):
| firmware version | SDK | Device Type | Device Model/info | Notes |
|---|---|---|---|---|
| 1.0.10 | 3.11.24 | oem_t1_slide_strip_ty | RGBIC Light Strips | * |
| 1.0.13 | 3.11.31 | oem_t1_slide_strip_ty | RGBIC Light Strips | * |
| 1.0.14 | 3.11.31 | oem_t1_strip_ty | RGB Light Strips | * |
| 1.0.24 | 3.11.35 | oem_t1_strip_ty | RGB Light Strips | ** |
| 1.0.28 | 3.11.31 | oem_t1_slide_strip_ty | RGBIC Light Strips | ** |
| 1.0.37 | 3.11.35 | oem_t1_slide_strip_ty | RGBIC Light Strips | ** |
| 1.0.43 | 3.11.24 | oem_t1_light | Lights | * |
| 1.0.50 | 3.11.35 | oem_t1_slide_strip_ty | RGBIC Light Strips | ** |
| 1.0.60 | 3.11.35 | oem_t1_slide_strip_ty | RGBIC Light Strips | ** |
| 1.0.76 | 3.11.34 | oem_t1_light_ty | Bulbs | * |
| 1.0.81 | 3.11.35 | oem_t1_light_ty | Bulbs | ** |
| 1.1.1 | 3.11.24 | oem_t1_irbox_mol_ty | IR Repeaters | * |
| 1.1.8 | 3.11.35 | oem_t1_plug | Plugs | ** |
| 1.1.8 | 3.11.35 | oem_t1_cutout_self_switch | Circuit Breakers | ** |
| 1.1.9 | 3.11.31 | oem_t1_switch | Switches & Relays | * |
| 1.1.17 | 3.11.35 | oem_t1_plug | Plugs | ** |
| 1.2.1 | 3.11.24 | oem_t1_irbox_mol_ty | IR Repeaters | * |
| 1.2.3 | 3.11.31 | oem_t1_switch | Switches & Relays | * |
| 1.2.5 | 3.11.31 | oem_t1_switch | Switches & Relays | * |
| 1.2.13 | 3.11.35 | oem_t1_switch | Switches & Relays | ** |
* = Not confirmed, but likely not patched
** = Not confirmed, but likely is patched
Most BK7231N devices will not be capable as very few have TuyaOS 3, and most that do have SDKs that are too old. Only a few devices are expected to possibly work, see the table below
BK7231N devices that might work with UnTuyaOS3:
| firmware version | SDK | Device Type | Device Model/info |
|---|---|---|---|
| 1.0.2 | 3.8.5 | oem_bk7231n_slide_strip_ty | RGBIC light strips |
| 1.0.3 | 3.11.12 | WP3 | Gosund WP3 Plug |
| 1.0.4 | 3.8.18 | oem_bk7231n_light_ty_v2 | Light Bulbs |
| 1.0.22 | 3.8.19 | oem_bk7231n_light_ty_v2 | Light Bulbs |
| 1.1.8 | 3.8.33 | oem_bk7231n_light_ty_v2 | Light Bulbs |
| 1.1.10 | 3.8.33 | oem_bk7231n_light_ty_v2 | Light Bulbs |
| 1.1.13 | 3.8.33 | oem_bk7231n_light_ty_v2 | Light Bulbs |
| 2.0.4 | 3.7.1 | tuyaos_ele_energy_outlet | ELEGRP In-Wall energy monitoring outlet |
| 3.1.16 | 3.8.17 | bk7231n_common_user_config_ty | TuyaMCU devices |
| 3.1.17 | 3.8.18 | bk7231n_common_user_config_ty | TuyaMCU devices |
| 3.1.28 | 3.11.1 | bk7231n_common_user_config_ty | TuyaMCU devices |
BK7231N devices that are TuyaOS3 but do not work with UnTuyaOS3:
| firmware version | SDK | Device Type | Device Model/info |
|---|---|---|---|
| various | Anything 3.3.# | various | various |
| 3.1.42 | 3.11.13 | bk7231n_common_user_config_ty | TuyaMCU devices |
Most RTL8720CF devices will not be capable as very few have TuyaOS 3, and most that do have SDKs that are too old. Only a few devices are expected to possibly work, see the table below
RTL8720CF devices that might work with UnTuyaOS3:
| firmware version | SDK | Device Type | Device Model/info |
|---|---|---|---|
| 1.0.12 | 3.5.3 | rtl8720cf_common_tcl_air_ty | Air Conditioners (Della Minisplit) |
| 3.1.23 | 3.8.15 | rtl8720cf_common_user_config_ty | TuyaMCU devices |
| 3.1.69* (* unverivied) | 3.11.25 | rtl8720cf_common_user_config_ty | TuyaMCU devices |
RTL8720CF devices that are TuyaOS3 but do not work with UnTuyaOS3:
| firmware version | SDK | Device Type | Device Model/info |
|---|---|---|---|
| various | Anything 3.3.# | various | various |