Shelly Pro 3 (SPSW-003XE16EU)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Assessment scope and uncertainty
Documentation assessment revised 24 October 2026. Scope is explicitly LIMITED to manufacturer factory-provisioned ESP32 production shipped with official firmware 2.0 or later, retaining its original security provisioning, current supported stock firmware, local administrator authentication enabled and HTTPS/WSS management. Optional plaintext integrations, MQTT without TLS, Modbus and debug RPC transports are excluded and must remain disabled in this profile. A firmware upgrade on an older unit does NOT establish this factory profile. The documents establish a manufacturer production policy; no individual serial number or exact model batch was inspected. Consequently this is a conditional documentation classification, not a certification of all units bearing this model number. No hardware test, flash dump or penetration test was performed.
The earlier legacy-unit storage assumption and resulting C scenario have been withdrawn. Storage is now tied to the manufacturer-documented factory-provisioned scope, not to an inference that an unverified older device is either encrypted or plaintext. Before applying this grade to a physical unit, confirm original provisioning with the vendor; otherwise storage and the total remain undetermined. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 maps the configurable API policy without enforced replacement/complexity; it does not allege that a particular user password is weak.
Device-specific findings
A DIN-rail smart switch with three independently controlled potential-free output circuits. DIN-rail enclosure with screw terminals, Ethernet and a tactile button that performs factory reset after 10 seconds. The three independent relay circuits remain physically accessible at the terminals.
One administrator can affect three circuits. Use a protected electrical enclosure and restrict access to the local management interface. Potential-free contacts describe the electrical interface; they are not a cybersecurity control.
Vulnerability evidence and applicability
Shared Gen2+ history: firmware 2.0.0 fixes an OTA authentication bypass. Exact affected builds for this model are not enumerated. This supports a platform-history judgment, not a confirmed model-specific CVE or an exploitable flaw in the assessed 2.0+ firmware.
No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model.
Score calculation
CRIS vector (website order): 2, 2, 1, 1, 2, 1, 1, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 2, User Authentication 2. Total 6; conditional documentation grade B.
This grade applies only to the stated factory security profile and configured channels. For an unidentified or legacy production batch, storage and the overall grade are not established. Similar totals across these models reflect common platform controls and category rounding, not independent measurements or proof of identical hardware security.
Practical improvements
Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade.
Date and research limits
Release date field: 2022-09-13 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: retailer record.
This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence.
Sources
- Exact-model identification and physical interfaces
- Model API and supported components
- WikiIoT methodology
- WikiIoT Classification form
- Shelly firmware update policy
- Shelly authentication
- Shelly HTTPS configuration
- Shelly RED security changes
- Shelly debug logs
- Shelly firmware changelog
- Shelly system configuration
- Shelly common device service / SetAuth
- Nozomi original CVE-2025-12056 advisory
- CVE Program record CVE-2025-12056
- ESP32 hardware flash encryption design
