Shelly Plus 1PM (SNSW-001P16EU)

Security Grade

A-

Calculator v1

Shelly Plus 1PM

   Brand: Shelly (Parent: Shelly Group AD (formerly Allterco Robotics))

   Category: Smart Relay • Model / Gen: Plus series (Gen2) SNSW-001P16EU

   Release Date: 2021-12-30 • Status: End of sale

   Classification Date: 2026-10-26 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	https://devices.esphome.io/devices/Shelly-Plus-1PM 🔗 Proof	Custom firmware flashing is documented via Tasmota/ESPHome, but physical access to an installed relay is limited and no public tampering campaign was found.
Known vulnerabilities	Rare	https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-02 🔗 Proof	NVD lists Shelly CVEs for Pro 4PM, TRV and the Home app, but none specific to Plus 1PM. The 2025 CISA advisory covers Pro 4PM only, so family-level risk remains.
Prior attacks	None	https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-02 🔗 Proof	No Shelly product is in CISA KEV, and CISA states that no public exploitation of the Pro 4PM denial-of-service issue (CVE-2025-11243) was reported. No Plus 1PM campaign was found.
Updatability	Very common	https://kb.shelly.cloud/knowledge-base/shelly-plus-1pm-web-interface-guide 🔗 Proof	Firmware is updated from the Shelly app or the local web UI, including optional automatic updates. Custom firmware upload is also permitted, though Shelly says it voids the warranty.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ 🔗 Proof	Supports Home Assistant, Alexa, Google Home, Apple HomeKit and Matter, plus a local RPC and MQTT API protected by digest authentication, enabling authenticated third-party control.
Communications	Encrypted with up-to-date encryption	https://www.shelly.com/products/shelly-plus-1pm 🔗 Proof	From firmware 2.0 Shelly enforces HTTPS/WSS with TLS 1.2 and validates outbound TLS chains; earlier firmware exposed plain HTTP. TLS and custom certificates are also listed as product features.
Storage	Encrypted with up-to-date encryption	https://www.shelly.com/products/shelly-plus-1pm 🔗 Proof	Shelly documents encrypted flash for secrets and certificates with hardware flash encryption. The page limits this to newly produced devices, so at-rest protection on this discontinued model is partly inferred.
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Basic	https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ 🔗 Proof	Shelly Cloud offers an email account with confirmation, password reset, a home PIN lock and installer access. No account-level MFA or role hierarchy is documented.
Authentication	Basic	https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ 🔗 Proof	Cloud login is email and password only. Local access uses SHA-256 digest authentication, with an admin password required during the 15-minute setup window on firmware 2.0+. No second factor is offered.
Brute-force protection	Exist	https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ 🔗 Proof	Firmware 2.0+ applies exponential backoff (10 s to 5 min) and rate limiting to all authentication endpoints, and locks accounts after repeated failures. Counters reset on device reboot.
Event logging	Partial logging	🔗 Proof	The app's activity log records device events such as on/off with date and time. No login, authentication or permission-change audit log is documented.
Passwords	Require change after setup	https://www.shelly.com/products/shelly-plus-1pm 🔗 Proof	There is no default device password. Users set the account password at signup and may optionally enable web-UI authentication. Password complexity rules are not published.
Category Score	Score: 2 / 3

Property	Details
Operating System & App	Shelly OS (proprietary, ESP-IDF/FreeRTOS-based) (Companion App: Shelly Smart Control app)
Hardware (CPU / GPU)	CPU: ESP32-U4WDH, single-core 160 MHz • GPU: N/A
Memory & Storage	Memory: N/A (internal SRAM not published) • Storage: 4 MB flash
Power, Battery & Charging	Battery: None (mains powered) • Power: 110-240 VAC or 24-30 VDC; consumption below 1.2 W • Charging: N/A
Display & Camera	Display: None (single-colour status LED) • Camera: None
Sound & Connectivity	Sound: None • Connectivity: Wi-Fi 2.4 GHz 802.11b/g/n; Bluetooth 4.2; proprietary add-on serial interface
Physical (Dimensions & Mass)	Dimensions: 37 x 42 x 16 mm (+/-0.5 mm) • Mass: 27 g

Student assignment submission for IoT security assessment.