Shelly Camera

Shelly Camera
Security Grade B Calculator v1	Shelly Camera Brand: Shelly (Parent: Shelly Group SE) Category: Smart Security Camera • Model / Gen: First generation S1CM-0DXW00 Release Date: 2026-09-03 • Status: In sale Classification Date: 2026-11-01 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	No publicly confirmed hardware tampering incidents specifically involving the Shelly Camera model S1CM-0DXW00 were established from the reviewed sources. No independent physical tamper-resistance assessment has been performed.
Known vulnerabilities	None	🔗 Proof	No model-specific CVE or confirmed vulnerability was established from the reviewed sources as of October 24, 2026. This does not demonstrate that the product is free of security vulnerabilities. Firmware advisories and security databases should be monitored.
Prior attacks	None	🔗 Proof	No publicly confirmed cyberattack specifically targeting Shelly Camera model S1CM-0DXW00 was established in the reviewed sources. The device has network-accessible services that should be protected by appropriate configuration and network controls.
Updatability	Very common	🔗 Proof	The Shelly Camera supports firmware updates through its embedded web interface. Users can inspect the installed firmware version, check for available updates and install new firmware. Firmware updates can provide functionality improvements, bug fixes and security patches.
Category Score	Score: 1 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Shelly Camera supports optional password authentication for its embedded web interface and allows TLS certificate configuration. However, authentication is not established as mandatory across every local integration or communication interface. Partial authentication is selected because protection depends on the chosen configuration.
Communications	No encryption	🔗 Proof	Shelly explicitly states that the camera's RTSP streams are not encrypted. Anyone able to capture the relevant network traffic may be able to view streamed video and audio. The device also supports TLS certificate configuration for other services, so this rating specifically reflects an enabled RTSP stream rather than every communication channel.
Storage	Encrypted with up-to-date encryption	🔗 Proof	Shelly Camera supports encrypted cloud recordings that require a user-defined encryption password for decryption. This classification applies to correctly configured Shelly Cloud recording storage. Encryption of recordings stored on a local microSD card has not been verified, and the same rating should not automatically be applied to local storage.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Shelly Camera integrates with Shelly Smart Control for device and account-based management. Users can configure camera settings, notifications and recording services. However, comprehensive local multi-user role management has not been established in the reviewed documentation.
Authentication	Basic	🔗 Proof	The Shelly Camera supports optional password-based authentication for its embedded web interface. Once authentication is enabled, a configured password is required to access the interface. Because authentication is optional, Basic is used as a conservative preliminary classification.
Brute-force protection	Basic	🔗 Proof	The camera provides optional password-based web interface authentication. However, the reviewed documentation does not confirm a model-specific account lockout policy, progressive login delays or rate-limiting mechanism. Basic protection is a provisional selection only and requires firmware-specific verification.
Event logging	Partial logging	🔗 Proof	Shelly Camera records motion-triggered events and provides event history and notifications through Shelly Smart Control. The web interface also provides debugging options. However, comprehensive security audit logging of failed logins and administrative activities has not been established.
Passwords	Default/Common/Easy to guess	🔗 Proof	Password authentication for the embedded web interface is optional and can be configured by the user. Mandatory initial password changes and enforced password complexity requirements were not established in the reviewed documentation. The selected rating is only an approximation of the optional authentication posture, not proof of a known weak default password.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Proprietary embedded firmware (OS not publicly specified) (Companion App: Shelly Smart Control)
Hardware (CPU / GPU)	CPU: Ingenic T23N • GPU: Not publicly specified
Memory & Storage	Memory: Not publicly disclosed • Storage: microSD card up to 512 GB (not included); internal flash capacity not disclosed
Power, Battery & Charging	Battery: None • Power: 5 V DC, 1 A via USB-C • Charging: Not applicable
Display & Camera	Display: None • Camera: 1920 × 1080 Full HD; 110° horizontal / 70° vertical field of view; black-and-white night vision
Sound & Connectivity	Sound: Built-in microphone and speaker; two-way audio • Connectivity: Dual-band Wi-Fi (2.4/5 GHz), Bluetooth 4.2, RTSP, WebRTC, MQTT, WebSocket
Physical (Dimensions & Mass)	Dimensions: 60 × 53 × 53 mm • Mass: 60 g

Shelly Camera (model S1CM-0DXW00) is a compact smart security camera developed by Shelly Group SE. The product was presented in Shelly's IFA 2026 announcements on September 3, 2026, and is commercially available through the European Shelly store.

The device uses an Ingenic T23N processor and provides Full HD 1920 × 1080 video recording, black-and-white night vision, motion detection, two-way audio, and remote monitoring.

It supports dual-band Wi-Fi, Bluetooth 4.2, RTSP, WebRTC, MQTT and WebSocket integrations. The camera can store video recordings locally on a microSD card with capacity up to 512 GB or through Shelly Cloud.

The product includes customizable motion detection zones, event history, cloud-based AI object recognition, and privacy controls. Privacy Mode disables video recording, the microphone and the speaker.

Security-related capabilities include optional password authentication for the embedded web interface, configurable TLS certificates, encrypted cloud recordings and firmware updates.

An important security limitation is that RTSP video streams are not encrypted. Shelly recommends enabling authentication and restricting RTSP traffic to trusted local networks.

This preliminary assessment is based on publicly available Shelly product specifications, technical documentation and security guidance reviewed as of October 24, 2026.

No publicly confirmed model-specific hardware tampering incidents or targeted attacks were established from the reviewed sources. The absence of published incidents does not establish that the device is free of vulnerabilities.

Additional technical verification is required for local storage encryption, brute-force protection, mandatory password requirements and comprehensive security event logging.