Shelly Pro 3EM (SPEM-003CEBEU)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Assessment scope and uncertainty
Revised documentation assessment, 23 October 2026. Scope: an existing unit originally shipped before firmware 2.0, subsequently running a model-supported official 2.0+ release, with local administrator authentication enabled. No factory security provisioning, HTTPS server certificate, mandatory password policy or complete encrypted flash is assumed. The score evaluates this legacy-unit configuration, not every production batch or the strongest achievable configuration. No physical device, firmware dump, penetration test or live update query was used. Check the exact model and firmware before applying these findings.
PROVISIONAL CLASSIFICATION: the form lacks Unknown and Mixed options. In particular, Storage=No encryption is a conservative risk-model assumption for unverified legacy-unit storage, NOT a finding that plaintext storage has been observed. It requires reviewer acceptance or model/batch evidence before this can be an unconditional classification. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 reflects lack of a verified mandatory replacement/complexity policy in the legacy profile, not a claim that every user selected a weak password.
Device-specific findings
A DIN-rail three-phase energy meter for monitoring electrical consumption. The assessed product is the 120 A model, not the separately marketed V2 product. DIN-rail meter with accessible screw terminals, a proprietary serial add-on interface and a documented 10-second factory reset. A secured electrical cabinet is an external control.
Consumption history can reveal occupancy patterns. Restrict access to exported measurements and keep optional Modbus services isolated. Do not confuse energy-measurement logs with authentication audit logs.
Vulnerability evidence and applicability
CVE-2025-12056 names Pro 3EM: an unauthenticated adjacent-network attacker can cause reboot/DoS (CVSS 4.0: 8.3). Nozomi lists versions below 1.4.4, while the CVE structured range includes 1.4.4. The advisory also leaves patch availability unclear. Do not certify 1.4.4 as fixed; confirm remediation with the vendor. Rare is frequency, not severity. See version discussion below.
Primary advisory: Nozomi CVE-2025-12056. The public CVE record contains a boundary inconsistency (<1.4.4 in prose versus <=1.4.4 in structured data). The reviewed manufacturer changelog does not explicitly tie a fixed release to this CVE. The 2.0+ profile is numerically later than both stated ranges, but this review has not independently verified remediation. Until vendor confirmation, isolate management access and restrict access from untrusted adjacent networks.
No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model.
Score calculation
CRIS vector (website order): 2, 2, 1, 1, 2, 3, 3, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 3, User Authentication 2. Total 7; provisional grade C.
Storage is unresolved. Replacing its assumed score 3 with a verified score 1 would reduce this profile to grade B; therefore the displayed C is a conservative scenario, not a verified product-wide grade. Without the assumed authentication and firmware, other scores also require reassessment. Similar totals across these products reflect shared controls and category rounding, not ten independent security architectures.
Practical improvements
Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade.
Date and research limits
Release date field: 2023-01-17 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: retailer record.
This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence.
Sources
- Exact-model identification and physical interfaces
- Model API and supported components
- WikiIoT methodology
- WikiIoT Classification form
- Shelly firmware update policy
- Shelly authentication
- Shelly HTTPS configuration
- Shelly RED security changes
- Shelly debug logs
- Shelly firmware changelog
- Shelly system configuration
- Shelly common device service / SetAuth
- Nozomi original CVE-2025-12056 advisory
- CVE Program record CVE-2025-12056
