Shelly Pro 3 (SPSW-003XE16EU)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	DIN-rail enclosure with screw terminals, Ethernet and a tactile button that performs factory reset after 10 seconds. The three independent relay circuits remain physically accessible at the terminals. Qualitative exposure judgment; no attack-frequency statistic.
Known vulnerabilities	Rare	[1] 🔗 Proof	Shared Gen2+ history: firmware 2.0.0 fixes an OTA authentication bypass. Exact affected builds for this model are not enumerated. This supports a platform-history judgment, not a confirmed model-specific CVE or an exploitable flaw in the assessed 2.0+ firmware.
Prior attacks	None	[2] 🔗 Proof	No model-attributed in-the-wild attack identified in the reviewed advisories and searches as of 2026-10-23. These sources do not establish zero attacks. CVEs describe vulnerabilities, not proof of exploitation.
Updatability	Very common	[3] [4] 🔗 Proof	This model is outside the published feature-freeze list; full firmware updates continue. Confirm the offered build on the device.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[5] 🔗 Proof	Digest protection has documented channel exceptions; authentication settings for integrations require separate review. Mutual authentication is not universal.
Communications	No encryption	🔗 Proof	For a pre-2.0 factory unit upgraded without installing an HTTPS server certificate, local HTTP remains plaintext by default. HTTPS capability does not encrypt that existing path.
Storage	No encryption	[6] 🔗 Proof	UNVERIFIED for legacy batches: score 3 is an explicit conservative assumption, not observed plaintext. Manufacturer encrypted-secret claims apply to new production; upgrading alone does not establish encrypted storage. Reviewer confirmation required.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	One fixed local administrator; no separate least-privilege local roles are documented.
Authentication	Basic	[7] 🔗 Proof	Authentication is enabled in this profile, but plaintext transport and physical recovery limit assurance; rated Basic rather than Secure.
Brute-force protection	Exist	🔗 Proof	Firmware 2.0+ documents progressive failed-login delays; reboot clears counters. This is conditional on running that firmware.
Event logging	Partial logging	🔗 Proof	Optional diagnostics include RPC activity and client/channel details; disabled by default, limited buffering, no complete authentication audit guarantee.
Passwords	Default/Common/Easy to guess	[8] 🔗 Proof	Legacy policy does not establish mandatory password replacement or complexity. Score 3 rates that policy gap, not the actual strength of an individual password.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Official Shelly Gen2 firmware; legacy-unit 2.0+ profile (see scope) (Companion App: Shelly Smart Control (optional))
Hardware (CPU / GPU)	CPU: ESP32-D0WDQ6 • GPU:
Memory & Storage	Memory: • Storage: 8 MB flash
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 802.11 b/g/n; Bluetooth 4.2; Ethernet RJ45
Physical (Dimensions & Mass)	Dimensions: • Mass:

Assessment scope and uncertainty

Revised documentation assessment, 23 October 2026. Scope: an existing unit originally shipped before firmware 2.0, subsequently running a model-supported official 2.0+ release, with local administrator authentication enabled. No factory security provisioning, HTTPS server certificate, mandatory password policy or complete encrypted flash is assumed. The score evaluates this legacy-unit configuration, not every production batch or the strongest achievable configuration. No physical device, firmware dump, penetration test or live update query was used. Check the exact model and firmware before applying these findings.

PROVISIONAL CLASSIFICATION: the form lacks Unknown and Mixed options. In particular, Storage=No encryption is a conservative risk-model assumption for unverified legacy-unit storage, NOT a finding that plaintext storage has been observed. It requires reviewer acceptance or model/batch evidence before this can be an unconditional classification. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 reflects lack of a verified mandatory replacement/complexity policy in the legacy profile, not a claim that every user selected a weak password.

Device-specific findings

A DIN-rail smart switch with three independently controlled potential-free output circuits. DIN-rail enclosure with screw terminals, Ethernet and a tactile button that performs factory reset after 10 seconds. The three independent relay circuits remain physically accessible at the terminals.

One administrator can affect three circuits. Use a protected electrical enclosure and restrict access to the local management interface. Potential-free contacts describe the electrical interface; they are not a cybersecurity control.

Vulnerability evidence and applicability

Shared Gen2+ history: firmware 2.0.0 fixes an OTA authentication bypass. Exact affected builds for this model are not enumerated. This supports a platform-history judgment, not a confirmed model-specific CVE or an exploitable flaw in the assessed 2.0+ firmware.

No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model.

Score calculation

CRIS vector (website order): 2, 2, 1, 1, 2, 3, 3, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 3, User Authentication 2. Total 7; provisional grade C.

Storage is unresolved. Replacing its assumed score 3 with a verified score 1 would reduce this profile to grade B; therefore the displayed C is a conservative scenario, not a verified product-wide grade. Without the assumed authentication and firmware, other scores also require reassessment. Similar totals across these products reflect shared controls and category rounding, not ten independent security architectures.

Practical improvements

Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade.

Date and research limits

Release date field: 2022-09-13 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: retailer record.

This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence.

Sources

• Exact-model identification and physical interfaces
• Model API and supported components
• WikiIoT methodology
• WikiIoT Classification form
• Shelly firmware update policy
• Shelly authentication
• Shelly HTTPS configuration
• Shelly RED security changes
• Shelly debug logs
• Shelly firmware changelog
• Shelly system configuration
• Shelly common device service / SetAuth
• Nozomi original CVE-2025-12056 advisory
• CVE Program record CVE-2025-12056