| Shelly Plug S
|
|
Security Grade
Calculator v1
|
Shelly Plug S
Category: Smart Plug • Model / Gen: 2 Shelly Plug S (SHPLG-S)
Release Date: 2020-06-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Published Shelly findings are local/adjacent-network issues such as cleartext Wi-Fi credentials during setup on the TRV (CVE-2023-42144); no mass physical-tampering case for the Plug S.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVEs exist for the Shelly ecosystem (app firmware-update information leak, CVE-2024-48776; Pro 4PM resource exhaustion, CVE-2025-11243) but no Plug S specific advisory was found, hence Rare rather than Very common.
|
| Prior attacks
|
None
|
🔗 Proof
|
No Shelly product appears in CISA KEV and no public attack campaign against the Plug S was identified.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware is upgradeable OTA from the app or the local web UI, and Shelly publishes firmware archives per device generation.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Device authenticates to the Shelly Cloud with a per-device token and can also be integrated via MQTT/Home Assistant with scoped credentials.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Cloud and app traffic is TLS with certificate validation; local API can be switched to HTTPS/authenticated mode.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Wi-Fi credentials and cloud tokens are stored in protected flash and are not readable through the documented API; no user content is stored.
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Shelly account manages rooms, sharing and device ownership transfer, with the local web UI protected by a device password.
|
| Authentication
|
Basic
|
🔗 Proof
|
Account password plus device-level password for the local UI; no enforced MFA on the plug itself.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Cloud login is rate limited; the local web UI has no configurable lockout after failed attempts.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Device keeps switch/energy history and can emit events to MQTT, but there is no authentication audit log.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
The device password must be set at commissioning (no default) and the cloud account enforces complexity.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Shelly embedded firmware (ESP8266 class) (Companion App: Shelly Smart Control app / local web UI)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: Onboard flash for configuration and schedules
|
| Power, Battery & Charging
|
Battery: • Power: AC 230 V, max 2500 W • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi, Bluetooth (newer firmware), local HTTP/RPC API, MQTT
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: Shelly devices are designed around local-first control with no mandatory cloud dependency, which removes a large class of consumer-IoT risk: pairing requires setting a device password and cloud tokens are per-device. The CVE record for the Shelly ecosystem is small and no Plug S specific issue was found, but the platform also enforces no MFA and has almost no authentication logging. Scope note: rated for a current firmware plug used with the local API or Shelly Cloud; exposing the local HTTP API without a password would lower the system criteria sharply. The non-Pro Plug S has been superseded by the Plus/Gen3 line and is assessed as end of sale.
