# Scan a product to check its security record

Scan the label on a router, camera or smart plug with HARD for iPhone to see its published security flaws, which are used in attacks, and what to do.

Source: https://hard.fyi/docs/iphone/scan-a-product/

**Scan a product** checks a gadget against the public record of security flaws: routers, cameras, video doorbells, baby monitors, smart plugs, printers, network storage, phones. Use it in a shop before you buy one, or on one that’s already in the house.

## How to use it

1. Tap **Scan** at the bottom of HARD, or **Scan a product** on Home. Point the camera at the label on the box, or the sticker under the device. When HARD has read the brand and model, tap **Check**.
2. Make sure the brand and model are right, and fix them if not. The exact model matters: a RAX20 and a RAX200 have different flaws. No label to hand? Tap **Choose a photo** or **Type it in**.
3. Tap **Check this model**. The first check can take up to a minute.

## What it checks

<dl>
<dt>Published flaws</dt><dd>Every flaw in the US National Vulnerability Database that names the model, and how many are rated critical.</dd>
<dt>Flaws used in attacks</dt><dd>Which of them are on CISA’s list of flaws <a href="/cve/">being used in real attacks</a>.</dd>
</dl>

Then it says what to do, in plain English:

<dl>
<dt>Update it today</dt><dd>A flaw in it is being used in attacks. If the maker has no fix, replace it.</dd>
<dt>Make sure it’s updated</dt><dd>It has known flaws, and HARD says which firmware fixes them.</dd>
<dt>No flaws found</dt><dd>Nothing published names it. That’s not a guarantee, so keep it updated anyway.</dd>
</dl>

Under that are the steps to lock it down for its kind of device, a link to the maker’s security page when HARD knows it, and what to look for in a safer one.

## What leaves your phone

The photo is read on your iPhone and never uploaded. Only the model name is sent, to the US National Vulnerability Database. HARD downloads CISA’s whole list and checks it on the phone, so CISA never learns what you looked up.

## Questions

### Does HARD upload the photo of the label?

No. HARD reads the photo on your iPhone, and it never leaves the phone. Only the model name is sent, to the US National Vulnerability Database, to look it up.

### HARD found no flaws. Is it safe?

Not necessarily. No published flaws means no researcher has written one up, and many devices are never examined at all. Keep it updated, and change any password printed on its label.