| Shelly Plug S (SHELLYPLUG-S) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Shelly Plug S
Brand: Shelly (Parent: Allterco Robotics) Category: Smart plug • Model / Gen: 1st generation SHELLYPLUG-S Release Date: 2019-09-01 • Status: End of sale Classification Date: 2026-10-24 • Official Website | |
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Consumer plug form factor; the enclosure can be opened to reach the PCB. |
| Known vulnerabilities | Rare | 🔗 Proof | 2025-11243 Same brand-level finding as Shelly 1PM; CVE-2025-11243 targets the Pro 4PM line. |
| Prior attacks | None | 🔗 Proof | No public evidence of in-the-wild exploitation against Shelly plugs. |
| Updatability | Very common | 🔗 Proof | Regular OTA firmware delivery through the Shelly Smart Control app. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | The JSON-RPC surface is reachable over HTTP, WebSocket and MQTT with authentication disabled in the default configuration. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Cloud channel uses TLS; local HTTP access is plaintext. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | No vendor statement on encryption of data at rest in flash. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Shelly Cloud account with limited role separation. |
| Authentication | Basic | 🔗 Proof | Local web UI credentials must be activated manually by the user. |
| Brute-force protection | Absent | 🔗 Proof | Shelly devices rely on optional credential protection without documented lockout mechanisms. |
| Event logging | Partial logging | 🔗 Proof | Only limited activity history is available in the app. |
| Passwords | Require change after setup | 🔗 Proof | Credentials set at commissioning, without documented complexity enforcement. |
| Category Score | Score: 3 / 3 | ||
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (ESP8266) (Companion App: Shelly Smart Control) |
| Hardware (CPU / GPU) | CPU: ESP8266EX • GPU: |
| Memory & Storage | Memory: • Storage: 2 MB flash |
| Power, Battery & Charging | Battery: • Power: 110-240 V AC, 12 A max • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: Wi-Fi 802.11 b/g/n |
| Physical (Dimensions & Mass) | Dimensions: 44 x 44 x 70 mm • Mass: approx. 60 g |
Overall assessment: The Shelly Plug S shares the Shelly Gen1 platform with the 1PM: active OTA and TLS-protected cloud traffic, but opt-in local authentication and no documented encryption at rest. Its plug form factor makes the PCB more accessible than in-wall models.
