Without access to an actual HOMETOUCH 7 device, it's very difficult to evaluate whether the device can realistically be modified or whether an agent could be installed using alternative methods.
From what has been discovered so far, the main blocker appears to be the firmware signature verification. Recovering the firmware password and repacking an image is one thing, but if the bootloader or updater enforces cryptographic signature checks, that becomes a completely different challenge.
The interesting question is whether there are other attack surfaces that avoid firmware replacement entirely, for example:
Existing network services
Hidden maintenance or diagnostic interfaces
Backup/restore functionality
Update mechanisms other than the main firmware updater
Debug ports (UART, USB, JTAG, etc.)
Vulnerabilities in the Android userspace
From the information available, the HOMETOUCH 7 appears to be Android-based, which potentially opens additional research paths compared to the Classe 300X. However, without a real device it is impossible to determine which services are exposed, whether shell access can be obtained, or whether privilege escalation paths exist.
Today, with tools such as Codex and modern security analysis tooling, it would be quite feasible to perform a systematic review of extracted firmware images, Android applications, update packages, and network services in search of weaknesses. But ultimately someone needs physical access to a device to validate any findings.
If someone has a HOMETOUCH 7 available for testing, that would likely be the most valuable next step.
On-demand camera workflow for opening the doorstation from Home Assistant when nobody is ringing.
Real doorbell Ring Call workflow: answer and hang up the incoming C300X call from Home Assistant with video, device audio and microphone talkback.
Audio-only Home Call workflow from Home Assistant to the C300X.
Dedicated Home Assistant media-user handling. The agent prefers a homeassistant device user when present and falls back to an existing valid C300X user only when needed.
Bundled Lovelace card setup for the doorstation and Home Call workflows,
including visual editor support and multi-device entity matching.
Android and iOS notification examples for door calls, dashboard open actions, Android high-priority/alarm-stream delivery and iOS critical alerts.
