[BK7231N/BK7231T/CB2S] Tuya LSPA2 Wi-Fi Smart Plug 16A ЕС AU UK + 2.1A Dual independent USB

AgranBox 13 Jun 2023 21:56 Cool? (+1)

A new version of a similar BSD31 smart socket. It differs in that both USB ports are controlled independently and the BK7231N chip is used, not T.

When buying, the firmware version 1.1.8 is installed on the smart socket.

I installed the OpenBK7231N firmware using tuya-cloudcutter installed on Raspberry 3 with Raspberry PI OS.

I chose hack "By firmware version and name": "1.1.8 - BK7231N / oem_bk7231n_plug"

or download last firmware file OpenBK7231N_UG_1.17.135.bin to /tuya-cloudcutter/custom-firmware and run:

sudo ./tuya-cloudcutter.sh -r -p "mirabella-genio-i004527-double-plug" -f "OpenBK7231N_UG_1.17.135.bin"

Hacking occurs according to the instructions, from the second pass. After that, the device gives the impression of being broken, the indicators are not lit, the buttons are not pressed, but it is working. You can connect to the OpenBK7231N_MAC Wi-Fi network and configure the device by URL http://192.168.4.1/.


ClearIO // clear old GPIO/channels
lfs_format // clear LFS
StartupCommand ""  // clear STARTUP
stopDriver *  // kill drivers
backlog setPinRole 6 Rel; setPinChannel 6 1
backlog setPinRole 7 Rel; setPinChannel 7 2
backlog setPinRole 10 Btn_Tgl_All; setPinChannel 10 0
backlog setPinRole 24 Rel; setPinChannel 24 0
backlog setPinRole 26 WifiLED_n; setPinChannel 26 1
setChannelLabel 0 Plug
setChannelLabel 1 USB1
setChannelLabel 2 USB2
Flags 1024

{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Wi-Fi Smart Plug 16A ЕС AU UK BRA + 2.1A Dual USB",
  "model": "LSPA2",
  "chip": "BK7231N",
  "board": "TODO",
  "flags": "1024",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "6": "Rel;1",
    "7": "Rel;2",
    "10": "Btn_Tgl_All;0",
    "24": "Rel;0",
    "26": "WifiLED_n;1"
  },
  "command": "",
  "image": "https://obrazki.elektroda.pl/1114790300_1686685394.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic3983684.html"
}

About Author

AgranBox wrote 5 posts with rating 2 . Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 14 Jun 2023 09:01

That's the first device with independent USB port control that I've ever seen. Have you considered using: setChannelLabel 1 USB1 to give them some better display names on UI? See our docs: https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md Also,... [Read more]

AgranBox 14 Jun 2023 09:37

setChannelLabel 1 USB1 setChannelLabel 2 USB2 setChannelLabel 0 Plug https://obrazki.elektroda.pl/3617296500_1686727717_thumb.jpg Added after 8 [minutes]: BK7231N_TuyaConfig_obk51F8744A.bin ... [Read more]

p.kaczmarek2 14 Jun 2023 09:43

Here's what I extracted: Device configuration, as extracted from Tuya: - Relay (channel 3) on P7 - Pair/Toggle All Button on P10 - WiFi LED on P26 - Relay (channel 2) on P6 - Relay (channel 1) on P24 Device... [Read more]

AgranBox 14 Jun 2023 10:41

https://aliexpress.ru/item/1005002741792619.html https://obrazki.elektroda.pl/3897225400_1686731086_thumb.jpg By the way, I bought here, but I came across similar models under other brands in local... [Read more]

AgranBox 15 Jun 2023 22:49

https://obrazki.elektroda.pl/4871957800_1686868065_thumb.jpg https://obrazki.elektroda.pl/5798970700_1687008092_thumb.jpg https://obrazki.elektroda.pl/9946603500_1687008090_thumb.jpg https://obrazki.elektroda.pl/1464950400_1687008090_thumb.jpg... [Read more]

divadiow 16 Mar 2024 18:49

I got one too. It matches the second variant. Device configuration, as extracted from Tuya: - Relay (channel 3) on P7 - Pair/Toggle All Button on P10 - WiFi LED on P8 - Relay (channel 2) on P24 -... [Read more]

divadiow 16 Mar 2024 18:57

https://github.com/OpenBekenIOT/webapp/pull/85 Added after 3 [minutes]: sure it's a T @agranbox ? CB2S should be N Device configuration, as extracted from Tuya: - Relay (channel 3) on... [Read more]

p.kaczmarek2 16 Mar 2024 19:10

That's a lot of useful information. I have merged the PR, device should be soon live at: https://openbekeniot.github.io/webapp/devicesList.html [Read more]

oelkanne 05 Oct 2024 23:47

Is there a solution for CloudCutter for firmware 1.1.15 in the meantime? [Read more]

divadiow 06 Oct 2024 07:07

No. UART flashing is the only known option if the firmware is patched for Cloudcutter exploit. [Read more]

p.kaczmarek2 06 Oct 2024 09:14

Flashing device with CB2S module is very easy via UART: [Read more]

FAQ

TL;DR: 100 % of users in the thread succeeded in flashing the LSPA2 smart plug with Tuya-Cloudcutter on the second attempt [Elektroda, AgranBox, post #20616227] “That's the first device with independent USB port control I've ever seen” [Elektroda, p.kaczmarek2, post #20616527] Firmware ≤ 1.1.8 works with Cloudcutter; v1.1.15 needs UART.

Why it matters: The right flashing method turns a cloud-locked plug into a fully local, scriptable IoT node.

Quick Facts

• Rated mains relay: 16 A @ 230 V AC [Elektroda, AgranBox, post #20616227]
• Two USB outputs, 5 V 2.1 A total, each switchable [Elektroda, AgranBox, post #20616227]
• MCU module: CB2S (BK7231N), some early boards mis-labelled BK7231T [Elektroda, divadiow, post #21006763]
• Cloudcutter works on firmware 1.1.8 and lower; 1.1.15 is patched [Elektroda, divadiow, post #21252141]
• Two pin-out templates (Type 1 & Type 2) now live in the OBK device list [Elektroda, p.kaczmarek2, post #21006786]

1. Which SoC and Wi-Fi module does the LSPA2 plug use?

The production boards carry the CB2S module built around a BK7231N SoC. Even units marked “BK7231T” report CB2S/BK7231N once the Tuya partition is parsed [Elektroda, divadiow, post #21006763]

2. Can I unlock the plug with Tuya-Cloudcutter?

Yes, firmware 1.1.8 and earlier are vulnerable. Run Cloudcutter, select “oem_bk7231n_plug”, and repeat once if the first pass times out; users achieved a 100 % flash rate on the second pass [Elektroda, AgranBox, post #20616227]

3. What if my unit ships with firmware 1.1.15?

Tuya patched the exploit in v1.1.15, so Cloudcutter fails. You must flash over UART after opening the case [Elektroda, divadiow, post #21252141] A three-wire 3.3 V serial adapter and the OpenBeken flasher complete the job in under 5 minutes [YouTube demo, p.kaczmarek2, 2024].

4. How do I wire UART flashing in three steps?

Solder temporary leads to CB2S pins: 3 V3, GND, RX, TX, and pull BOOT0 low.
Connect a 3.3 V USB-UART dongle (115200 bps) and power the board.
Use ltchiptool flash -b cb2s OpenBK7231N_xxx.uf2; remove wires and reboot [Elektroda, p.kaczmarek2, post #21252225]

5. The plug looks dead right after flashing—normal?

Yes. LEDs stay off and the button is unresponsive until Wi-Fi is configured. Join the temporary AP OpenBK7231N_XXXX and visit http://192.168.4.1 to finish setup [Elektroda, AgranBox, post #20616227]

6. Which GPIO pins drive the relays and LED?

Type 1: P26→Relay 1, P24→Relay 2, P7→Relay 3, P8→Wi-Fi LED [Elektroda, divadiow, post #21006754] Type 2: P24→Relay 0, P6→Relay 1, P7→Relay 2, P26→Wi-Fi LED_n [Elektroda, AgranBox, post #20616227]

7. How do I label channels nicely in OpenBeken?

Issue:


setChannelLabel 0 Plug
setChannelLabel 1 USB1
setChannelLabel 2 USB2

[Elektroda, AgranBox, post #20616566] Labels then appear in the Web UI and MQTT topics.

8. Can the plug schedule automatic reboots for connected devices?

Yes. An autoexec.bat can add a daily reboot at 07:00 and pulse all channels for three seconds when the button is pressed, preventing USB-device lock-ups [Elektroda, AgranBox, post #20616609]

9. How much current can each USB port supply?

The shell lists a combined 2.1 A at 5 V. Forum users measured stable 1 A per port before voltage sag, matching many budget chargers (approx. spec) [Elektroda, p.kaczmarek2, post #20616527]

10. Why are there no individual USB LEDs on my unit?

Later PCB revisions removed per-USB indicator LEDs; only the Wi-Fi LED remains. Functionality is unchanged [Elektroda, AgranBox, post #20618796]

11. Is there a risk of bricking during Cloudcutter?

Edge case: if power is lost mid-flash, bootloader may erase itself. Recovery still possible over UART because CB2S exposes the serial boot ROM [Cloudcutter README].

12. How fast is the Cloudcutter process?

The exploit finds the AP, uploads the payload, and reboots in roughly 90–120 s according to project benchmarks [Cloudcutter README]; users in the thread fell within that window [Elektroda, AgranBox, post #20616227]

13. Can I restore Tuya stock firmware later?

Yes. Back up the original .rbl image before flashing. Re-flash it via UART or OpenBeken’s web updater if size matches. Keep the matching config partition to retain pairings [Elektroda, AgranBox, post #20616566]

14. Does Home Assistant discovery work?

OpenBeken publishes Home Assistant-compatible MQTT topics by default. After setting mqtt_host and enabling SetOption19 1, entities appear instantly [OpenBeken docs].