TL;DR
Scott’s Blog published an account of efforts to reverse engineer a Wi-Fi-connected Coway Airmega IconS so it could be controlled without relying on Coway’s cloud service. The report describes the motivation, previous cloud integration failures and an attempted traffic-interception setup, but the supplied material does not establish that local control was achieved.
A report published by Scott’s Blog on November 11, 2026, describes an effort to reverse engineer a Coway Airmega IconS air purifier and reduce its reliance on Coway’s cloud service. The account explains why the existing Home Assistant route has proved unreliable and outlines an attempt to inspect the purifier’s network traffic; the available text does not show that the author succeeded in making the device operate locally.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The project grew out of a practical home-automation goal: linking the purifier’s fan to an Apple Home routine that turns off the lights at bedtime. The older Coway purifier in the household lacked Wi-Fi, so the author replaced it with the now-discontinued Airmega IconS, which can be controlled over Wi-Fi. The author says the purifier improves air quality and is also used as white noise at night.
Rather than offering a direct local connection, the existing setup relies on Coway’s IoCare cloud service. A community-built Home Assistant integration communicates with that service, and Home Assistant then exposes control to Apple Home. The author reports recurring interruptions, including changes to Coway’s app or web pages, server outages, and an account ban that lasted weeks while support reviewed it. These are the author’s experiences, not an independent account of Coway’s service record.
The report says the author began testing a man-in-the-middle traffic-inspection setup using a Raspberry Pi configured as a Wi-Fi access point and mitmproxy to log traffic. The aim was to observe how the purifier communicates with Coway and determine whether it might instead communicate with a local server. The excerpt describes this approach and the technical conditions that could make it possible, but gives no confirmed result, final method or working local-control implementation.
A More Reliable Route to Home Control
The project highlights a weakness of cloud-dependent smart-home devices: a product may still function as an air purifier while remote controls and automations fail because a manufacturer service or unofficial integration changes. For households that have built routines around a connected appliance, that can mean losing a useful feature even though the hardware remains in place.
A successful local-control method could reduce dependence on Coway’s servers and give users more direct control over automations. That outcome is not established in the supplied report excerpt. The work also raises a security consideration: inspecting or redirecting a device’s encrypted traffic depends on the device’s certificate checks and network configuration. The author presents those as technical conditions to investigate, not as proof that the purifier is vulnerable.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
DJI Mini 5 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
Why the Cloud Integration Failed
The author’s original Airmega did not have Wi-Fi. After it broke, the household bought the IconS to connect the fan to smart-home controls. Coway’s phone app was described by the author as slow and prone to repeated password prompts, prompting use of a community Home Assistant integration that acted through Coway’s cloud rather than connecting directly to the appliance.
The report lists past causes of disruption: Coway changed its app branding from IoCare to IoCare+, made changes that broke the integration’s scraping, and experienced service outages. The author also says Coway had banned the account for using an older integration version before support restored access. Coway’s service could also change or end in the future, the author argues, but the report supplies no announcement that Coway plans to discontinue or charge for it.
The author says an October 2026 certificate-authority security incident prompted a fresh look at traffic inspection. The excerpt characterizes the incident as involving weak parameters in some eMudhra private keys and suggests that this might provide a route to inspect traffic if the purifier is unpatched, trusts affected root certificates and does not pin the cloud certificate. Those are conditional claims in the blog account; the supplied material does not independently verify the incident’s technical scope or show that the IconS meets those conditions.
“The downside of this approach is that you’re still at the mercy (or lack thereof) of the Coway cloud service.”
— Scott, the author of Scott’s Blog
Local Control Still Unproven
The supplied excerpt ends as the author begins describing the Raspberry Pi and mitmproxy setup. It does not say whether the purifier’s traffic was successfully decrypted, whether the device accepts a locally operated endpoint, or whether fan controls can work without Coway’s service. It is also unclear whether the IconS is vulnerable to the certificate scenario discussed by the author, whether Coway has responded to the report, or whether the work applies to other Airmega models.
Testing the Purifier’s Network Traffic
The report’s next step, as described in the excerpt, is to place the purifier on an isolated Wi-Fi network routed through the Raspberry Pi and inspect the communications passing through mitmproxy. The author would need to establish what endpoints and protocols the device uses and whether its security checks permit the proposed inspection before a local-control approach could be assessed. The supplied material gives no timeline for further findings or a completed integration.
Key Questions
That is not confirmed in the supplied excerpt. It describes an investigation and an attempted traffic-inspection setup, but no working cloud-free control method.
Which Coway model is discussed?
The project concerns the Coway Airmega IconS, which the author says is discontinued. The report also mentions the Airmega 250S and MightyS as other Wi-Fi models, but does not say the investigation applies to them.
How does the existing Home Assistant setup work?
The community integration communicates with Coway’s IoCare cloud for status and commands. Home Assistant then connects that control to Apple Home routines; the report does not describe this as direct local control.
Why is the author trying to change the setup?
The author reports that cloud outages, app and website changes, and an account ban have disrupted remote control. The goal is to make a bedtime routine more dependable without relying on Coway’s servers.
Does the report establish a security flaw in the Airmega IconS?
No. The author discusses conditions that might allow traffic inspection, including certificate handling and whether the device is patched. The excerpt does not establish that the IconS has those characteristics or that its security was bypassed.
Source: scottjg.com
