| Shelly Plug S Gen3 (S3PL-00112EU)
|
|
Security Grade
Calculator v1
|
Shelly Plug S Gen3 (S3PL-00112EU)
Category: Smart Plug • Model / Gen: Gen3 S3PL-00112EU
Release Date: 2024-10-22 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
No model-specific hardware tampering case was found in the reviewed manufacturer advisories. The plug has a physical factory-reset button, so this is a provisional incident-frequency rating, not proof that tampering is impossible.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Shelly firmware 2.0.0 fixed an OTA authentication bypass and strengthened authentication. This is a platform-wide finding, not evidence of frequent vulnerabilities specific to this model.
|
| Prior attacks
|
None
|
🔗 Proof
|
No model-specific attack is documented in the reviewed manufacturer advisory index. Absence of a published report does not prove no attacks occurred.
|
| Updatability
|
Very common
|
🔗 Proof
|
Shelly says all Gen3 devices continue to receive firmware updates. The product web interface can check for and install updates.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
HTTP and WebSocket support SHA-256 digest authentication, but MQTT, UART and outbound WebSocket are outside that mechanism. Integration settings affect actual protection.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
On firmware 2.0+ with enhanced security, the local server uses HTTPS/WSS and validates TLS on outbound secure connections. Optional integrations can use different settings.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Shelly documents hardware flash encryption of secrets on newly produced devices. This rating does not establish storage protection on older units of the same model.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The local device supports a password for its fixed admin identity. Separate local user roles or privilege levels are not documented.
|
| Authentication
|
Secure
|
🔗 Proof
|
On firmware 2.0+ with enhanced security, local HTTP/WebSocket uses RFC 7616 SHA-256 digest over HTTPS/WSS. Some channels remain outside this mechanism.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Firmware 2.0+ tracks failed login attempts and applies progressive delays and HTTP 429 throttling. Earlier firmware may differ.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The web interface offers debug logs, but the reviewed documentation does not establish complete login and access auditing.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
On firmware 2.0+ initial admin-password setup must be completed in the setup window. No password-complexity requirement was confirmed; this form choice is approximate.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Shelly Gen3 firmware (assessed for version 2.0+) (Companion App: Shelly Smart Control (optional))
|
| Hardware (CPU / GPU)
|
CPU: ESP-Shelly-C38F • GPU:
|
| Memory & Storage
|
Memory: • Storage: 8 MB flash
|
| Power, Battery & Charging
|
Battery: • Power: 220-230 V AC, 50/60 Hz; device consumption <1 W; max switched load 12 A / 2500 W • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi 802.11 b/g/n; Bluetooth 4.2; Matter; MQTT
|
| Physical (Dimensions & Mass)
|
Dimensions: 44 x 44 x 70 mm • Mass: 60 g
|
Shelly Plug S Gen3 (S3PL-00112EU) is a Wi-Fi and Bluetooth smart plug with power measurement, a local web interface, and optional cloud and Matter integration. This documentation-based assessment was prepared on 22 October 2026 and assumes firmware 2.0 or later with enhanced security enabled. Shelly documents firmware updates, HTTPS/WSS for the local server, SHA-256 digest authentication, and brute-force throttling under those conditions. Shelly states that encrypted flash storage for secrets applies to newly produced devices only. The security state of an individual plug depends on its production batch, firmware version, and integration settings. Ratings for hardware tampering and past attacks are provisional because model-specific incident-frequency evidence was not found. The entered 22 October 2024 release date is the first documented retail availability located, not a manufacturer-confirmed launch date. This is not an independent penetration test.
