| Shelly Plug M Gen3 (S3PL-30110EU)
|
|
Security Grade
Calculator v1
|
Shelly Plug M Gen3 (S3PL-30110EU)
Category: Smart plug • Model / Gen: Gen3 S3PL-30110EU
Release Date: 2026-03-06 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
No Plug M Gen3 hardware-tampering incident was found in the reviewed manufacturer advisories. This is a provisional incident-frequency rating; the physical button permits factory reset.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Shelly Gen2+ firmware 2.0.0 fixed an OTA authentication bypass. This is platform-wide evidence, not confirmation that Plug M Gen3 was affected.
|
| Prior attacks
|
None
|
🔗 Proof
|
No model-specific attack is documented in the reviewed advisory index. Absence of a report does not prove none occurred.
|
| Updatability
|
Very common
|
🔗 Proof
|
The Plug M Gen3 app guide documents automatic update scheduling, version checks and manual update initiation; Shelly supports Gen3 firmware updates.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Local HTTP and WebSocket support SHA-256 digest authentication when enabled. MQTT, UART and outbound WebSocket are outside this mechanism; integration settings matter.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Firmware 2.0+ enforces HTTPS/WSS for the local web server and validates outbound TLS. This score assumes updated firmware and secure integration settings; earlier firmware and optional protocols may differ.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Shelly says newly produced devices store security assets in encrypted flash with unique keys. This is conditional on manufacturing batch; it does not establish protection of every Plug M Gen3 unit.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The app supports limited device sharing and revocation. Local device authentication uses a fixed admin identity; no separate local role system is documented.
|
| Authentication
|
Secure
|
🔗 Proof
|
When enabled, local HTTP/WebSocket authentication uses RFC 7616 SHA-256 digest. This rating assumes firmware 2.0+ and completed secure setup; some channels are outside this mechanism.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Firmware 2.0+ uses progressive delays, rate limiting and account lockout after repeated failed login attempts.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app has a global activity log, and this device can be excluded from it. Complete login and access auditing is not established.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Shelly says initial admin-password setup must be completed in a 15-minute setup window on firmware 2.0+. Password complexity is not documented; the form choice is an approximation.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Shelly Gen3 firmware (Companion App: Shelly Smart Control (optional))
|
| Hardware (CPU / GPU)
|
CPU: ESP-Shelly-C38F • GPU:
|
| Memory & Storage
|
Memory: • Storage: 8 MB flash
|
| Power, Battery & Charging
|
Battery: • Power: 220-240 V AC, 50 Hz; <1 W consumption; 13 A / 3000 W max load • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi 802.11 b/g/n; Bluetooth 4.2; Matter; MQTT
|
| Physical (Dimensions & Mass)
|
Dimensions: 46 x 46 x 85 mm • Mass: 73 g
|
Shelly Plug M Gen3 (S3PL-30110EU) is a 13 A Wi-Fi/Bluetooth smart plug with power measurement, Matter support, local web control and optional cloud/app integration. Source-based classification reviewed on 22 October 2026; no physical device was tested. The release date entered is the manufacturer's 6 March 2026 public announcement, not a verified retail launch date. Security ratings assume firmware 2.0+ with secure setup and integration settings. Encrypted flash storage is documented only for newly produced devices; an individual unit may differ by production batch and firmware. No model-specific hardware tampering or attack reports were found in the reviewed advisories, so those frequency ratings are provisional.
