| Shelly 1PM (SHELLY1PM)
|
|
Security Grade
Calculator v1
|
Shelly 1PM
Release Date: 2017-01-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
In-wall / DIN-rail installation limits casual physical access; PCB and terminals remain reachable once the enclosure is opened.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVE-2025-11243 is documented on the Shelly Pro 4PM line; the 1PM is not listed among affected products.
|
| Prior attacks
|
None
|
🔗 Proof
|
No public report of botnet recruitment or mass exploitation targeting Shelly relays.
|
| Updatability
|
Very common
|
🔗 Proof
|
Vendor shipped firmware 1.6.0 to remediate CVE-2025-11243, showing an active OTA update process
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Local HTTP / WebSocket / MQTT RPC interfaces are exposed; credential protection must be enabled by the user and is off by default.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Cloud and MQTT traffic use TLS; the local HTTP endpoint on port 80 remains unencrypted.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
No vendor documentation of encryption at rest for configuration and Wi-Fi credentials stored in flash.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Shelly Cloud account with limited role separation.
|
| Authentication
|
Basic
|
🔗 Proof
|
Local web UI credentials must be activated manually by the user.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
CVE-2025-11243 is pre-authentication: the crash is triggered during parsing, before authentication and ACL checks, so no lockout applies.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Only limited activity history is available in the app.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Credentials set at commissioning, without documented complexity enforcement.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded firmware (ESP8266) (Companion App: Shelly Smart Control)
|
| Hardware (CPU / GPU)
|
CPU: ESP8266 • GPU:
|
| Memory & Storage
|
Memory: ~50 KB SRAM • Storage: 2 MB Flash
|
| Power, Battery & Charging
|
Battery: • Power: 110–240 VAC / 24–60 VDC, <1 W • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 802.11 b/g/n (2.4 GHz), MQTT, CoAP
|
| Physical (Dimensions & Mass)
|
Dimensions: 36 × 41 × 17 mm • Mass: N/A
|
Overall assessment: The Shelly 1PM is a competent Gen1 Wi-Fi relay with active OTA support and TLS-protected cloud/MQTT channels. Its main weaknesses are opt-in local authentication (off by default), no brute-force lockout, unencrypted local HTTP, and no documented encryption at rest for Wi-Fi credentials. Known CVE-2025-11243 affects the Shelly Pro line, not this model, but it demonstrates weaknesses in the shared local API design.
