China IoT special: Espressif and Quectel grow fast, China Mobile's IoT connections dip, and connected cars get data rules

This week in brief

Espressif reported third-quarter revenue up 33% to 889 million yuan and says the IoT industry has moved from price competition on connectivity to competition on features.
Quectel's third-quarter revenue rose 35% to 8.54 billion yuan, while stockpiling of raw materials pushed its operating cash flow for the nine months to minus 1.86 billion yuan.
China Mobile's IoT card connections fell from 1.511 billion at the end of June to 1.497 billion at the end of September, with no reason given in its report.
Fibocom took over 37.16% of the car electronics maker Hangsheng and, with shareholders acting in concert with it, now controls the company, in a bid to sell systems directly to carmakers.
China announced two mandatory national standards on the security of connected cars' spatio-temporal data, in force from 1 October 2027.

This is a special issue, outside our Thursday schedule, on connected-device news from China. It is built from Chinese primary sources: government notices, stock exchange filings and company announcements. Quotations from Chinese texts are given in the original between « », followed by our own translation in double quotes. Figures from companies are reported as the company’s own claims; the quarterly reports cited here are unaudited, and amounts are in yuan as filed. The regular digest returns on Thursday 29 October.

Espressif grows a third and says IoT chips now compete on features

On 24 October, Espressif published its third-quarter report (Chinese) on the Shanghai Stock Exchange. Revenue for the quarter rose 33.38% from a year earlier to 889.28 million yuan, and net profit attributable to shareholders rose 89.35% to 218.70 million yuan. For the first nine months, revenue was 2.37 billion yuan (up 23.94%), gross margin 49.97%, and research and development took 21.87% of revenue. In the quarter, sales in China grew 38.5% and sales abroad 23.1%. The company says «智能家居行业整体需求表现相对平稳，非智能家居领域的下游应用仍保持较好的增长态势» (“overall demand in the smart home industry was relatively stable, while applications outside the smart home kept growing well”), and gives as the first reason for its higher gross margin: «物联网行业已从价格竞争的“连接驱动”阶段进入“功能驱动”阶段» (“the IoT industry has moved from a ‘connectivity-driven’ stage of price competition to a ‘function-driven’ stage”). Its operating cash flow trailed profit because, «在部分关键原材料价格存在上行预期的背景下，公司采取了相对积极的库存策略» (“with prices of some key raw materials expected to rise, the company adopted a relatively proactive inventory strategy”).

Why it matters: The ESP32 is a common choice of Wi-Fi and Bluetooth chip for makers and in many low-cost smart home devices, so the health of the company behind it matters to anyone building on it. Two things stand out. Espressif describes smart home demand as only relatively stable and puts its growth in other applications, which fits its push into processors and development platforms that issue 5 covered with ESP-Mosaico. And a chipmaker that buys stock early because it expects component prices to rise is a signal for product teams too: a bill of materials fixed today may not hold next year.

Quectel’s quarter: revenue up 35%, cash tied up in stock

On 20 October, Quectel, the Shanghai maker of cellular IoT modules, published its third-quarter report (Chinese). Third-quarter revenue rose 34.89% to 8.54 billion yuan and net profit attributable to shareholders rose 132.34% to 609.49 million yuan; for the nine months, revenue was 23.80 billion yuan (up 33.13%) and net profit 1.21 billion yuan (up 65.21%). The company says its modules and antennas, automotive, IoT solutions and on-device AI businesses grow together, and that «算力模组、车载、解决方案等业务均保持较好的增长态势» (“the compute module, automotive and solutions businesses all kept up good growth”). Operating cash flow for the nine months was minus 1.86 billion yuan, because «为保障生产经营需要及供应链稳定，公司加大了原材料储备力度» (“to secure production needs and a stable supply chain, the company stepped up its stockpiling of raw materials”). Total assets rose 40.49% since the end of 2025.

Why it matters: An IoT module is the certified block of radio, baseband and software that most device makers buy instead of designing cellular IoT hardware themselves, and Quectel’s numbers are a reading of that market worldwide. The company puts its growth in the higher-value parts, compute modules that run applications and AI next to the modem, and car modules, and says their share of sales rose. The negative cash flow echoes Espressif: two large Chinese IoT suppliers are building up component stocks, Espressif because it expects prices to rise, Quectel to secure production and a stable supply chain. Background on the networks these modules use is in NB-IoT and LTE-M explained.

China Mobile’s IoT connections fall in the third quarter

China Mobile’s third-quarter report (Chinese), dated 20 October and published on the Shanghai Stock Exchange on 21 October, lists under «蜂窝物联» (“cellular IoT”) the number of «物联网卡连接数» (“IoT card connections”): 1.497 billion at 30 September, down from 1.511 billion at 30 June. Net additions for the nine months were 15.03 million, against 29.58 million for the first half, which means the count fell by about 14.6 million in the third quarter. The report gives no reason. In the same period the operator’s mobile customers rose to 1.014 billion and its 5G network customers to 702 million; revenue for the nine months fell 1.8% to 780.3 billion yuan and net profit 7.9% to 106.2 billion yuan.

Why it matters: With about 1.5 billion IoT cards, China Mobile’s count is one of the few large, regularly published measures of cellular IoT, so even a small quarterly fall stands out. It does not necessarily mean fewer devices: the count is of SIM cards on its network, and it can drop when inactive cards are cancelled or customers move lines elsewhere, or when demand weakens. The filing does not say which, and the full-year results may give more detail. The contrast with Quectel is worth keeping in mind: module sales can grow fast while one operator’s connection count stalls, because modules ship worldwide and connect to many networks.

Fibocom takes control of a car electronics maker

On 21 October, Fibocom, a Shenzhen maker of wireless modules, announced (Chinese) that 37.16% of Shenzhen Hangsheng Electronics had been transferred to it. According to the implementation report (Chinese) published the same day, Fibocom pays 1.43 billion yuan in cash for the stake and, with shareholders who have agreed to act in concert with it, controls 51.40% of Hangsheng, which becomes its subsidiary. Hangsheng’s 2025 revenue of 4.84 billion yuan equals 69.20% of Fibocom’s own. The deal report (Chinese) filed in September says Hangsheng «主要从事汽车电子产品的研发设计、生产与销售» (“mainly designs, makes and sells automotive electronics”), with work in smart cockpits, intelligent driving and automotive acoustics, and that the deal is meant to «推动上市公司从 Tier 2 供应商升级为 Tier 1 供应商» (“move the listed company up from a Tier 2 supplier to a Tier 1 supplier”).

Why it matters: A Tier 2 supplier sells parts to the companies that build systems for carmakers; a Tier 1 sells those systems to the carmakers directly. Fibocom says the deal will raise the value of what it sells: the module, the piece that makes a connected car connected, goes into a complete cockpit or telematics unit instead of being sold on its own. For carmakers, module and system can now come from one group; for the Tier 1 suppliers that buy Fibocom modules today, their module vendor now controls a company that competes with some of them.

Goodix moves AI credentials into a secure chip, as memory prices weigh on device demand

On 19 October, Goodix launched a range of fingerprint products for IoT and AI devices, from match-on-host and match-on-chip sensors to a new combination of match-on-chip sensing and an embedded secure element (eSE). Matching happens inside the fingerprint module, which sends the result over an encrypted channel to the eSE; the eSE holds credentials such as API keys and login tokens, the solution supports FIDO2 and TLS 1.3, and, according to Goodix, sends credentials for cloud language models over an encrypted channel without exposing them in plain text to the host processor. Goodix says the eSE can also require a fingerprint for high-risk operations and keep tamper-resistant audit logs meant to stop AI agents altering the records. Four days later, its third-quarter report (Chinese) showed third-quarter revenue down 17.37% from a year earlier to 1.05 billion yuan, «主要受存储价格上涨对终端需求产生一定抑制，以及行业竞争加剧、产品销售价格承压等影响» (“mainly because rising memory prices held back demand for end devices to some extent, together with fiercer competition and pressure on selling prices”). Bestechnic, a Shanghai designer of chips for wearables and other consumer devices, said in its own report (Chinese) the same day that nine-month revenue fell 26.81% to 2.15 billion yuan, «受消费电子市场需求疲软、上游存储芯片涨价等因素影响» (“affected by weak demand in consumer electronics and rising prices of upstream memory chips”), though third-quarter revenue rose 16.66% from the second quarter; its next flagship wearable chip, the BES6100, has been taped out and is sampling to customers.

Why it matters: Once an AI agent on a phone, watch or home device can act for its owner, the keys it uses become a target, and keeping them in a secure element rather than in the main processor’s memory is the textbook answer, explained in device identity and PKI. The claims are Goodix’s own and no certification is named. The results add a different angle to the stockpiling at Espressif and Quectel: Goodix and Bestechnic both name rising memory prices as one reason demand for the devices that use their chips, from wearables to consumer gadgets, has weakened, and memory goes into almost every device.

China makes security rules for connected cars’ location data mandatory from October 2027

On 23 October, the market regulator SAMR announced (Chinese) a batch of 515 national standards and standardization guidance documents, and said it had issued «智能网联汽车时空数据安全、消防安全等7项公共安全强制性国家标准，聚焦智能网联数据防护与城乡火灾风险防控» (“seven mandatory national public-safety standards on subjects including the spatio-temporal data security of intelligent connected vehicles and fire safety, focused on protecting intelligent connected data and controlling fire risks in cities and the countryside”). The national standards portal lists the two car standards: GB 48319-2026 (Chinese), basic requirements for the security processing of connected vehicles’ spatio-temporal data, and GB 48320-2026 (Chinese), basic security requirements for the sensing systems that collect that data. Both were issued on 28 September, take effect on 1 October 2027 and fall under the Ministry of Natural Resources, which is responsible for maps and geographic data. Their drafters include Huawei, Baidu, BYD, NIO and Xpeng. Two days earlier, at the World Intelligent Connected Vehicles Conference (Chinese) in Beijing, MIIT vice minister Xin Guobin said the ministry would «加快运行监测、数据安全等重点标准研制» (“speed up work on key standards such as operation monitoring and data security”).

Why it matters: A connected car knows where it is at every moment and its sensors record the roads it drives. Both standards were drafted under China’s national technical committee for geographic information, which in our reading shows that China treats what a car’s sensors record as map data, and not only as a question of privacy. “GB” without “/T” means mandatory: from October 2027 every car in scope sold in China has to comply, whoever makes it. For foreign carmakers it is the data sovereignty question in concrete form. We describe the standards from their official listings; their detailed requirements are in the full texts.

CISA flags root-level flaws and a shared secret in a Chinese video encoder

On 22 October, CISA published advisory ICSA-26-295-01 for nine vulnerabilities in the E3 NDI encoder made by Kiloview, a company headquartered in China, in all firmware versions before 1.30. Three are OS command injection flaws that let an authenticated user run commands as root, scored up to 9.9 on CVSS v3.1. CVE-2026-92450 is a JSON Web Token signing secret stored as a static string in the firmware and identical on every device, so anyone with the firmware can forge administrator tokens. Through the ONVIF service, used to manage IP video devices, an unauthenticated attacker can read user account lists and change the device’s hostname, DNS and NTP settings. Login tokens effectively never expire. CISA says the encoder is deployed worldwide in the communications and IT sectors, that Kiloview recommends updating to version 1.30, and that no public exploitation has been reported to it.

Why it matters: This is the second advisory in a week about a secret baked into firmware, after the hard-coded key in the Moxa gateway in issue 5; here CISA says the secret is identical on every device. It is the same failure as default credentials, only harder to spot because no password screen shows it. Update the firmware, keep the management interface and the ONVIF service off networks that untrusted users can reach, as described under network segmentation, and see IoT security fundamentals for the wider checklist.

Sources

Topics: China, Espressif, Quectel, China Mobile, Fibocom, Goodix, connected cars