| Shelly Plus 1 (SNSW-001X16EU)
|
|
Security Grade
Calculator v1
|
Shelly Plus 1
Release Date: 2020-07-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
—
|
No hardware tampering reports found in my search.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
No CVE found for Plus 1 itself; related CVEs exist for other Shelly Gen2+ devices (e.g. CVE-2025-11243 on Pro 4PM, CVE-2023-33383).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No attacks on Plus 1 found; only researcher disclosures on related Shelly Gen2+ devices, none listed in CISA's exploited catalog.
|
| Updatability
|
Very common
|
🔗 Proof
|
Shelly publishes a UK PSTI compliance statement for Plus 1; a 5-year minimum security update period is reported for the Gen2 family.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Supports MQTT/WSS with TLS and custom certificates, but these are optional settings.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Supports TLS for cloud/MQTT/WSS; the local HTTP API is not encrypted by default.
|
| Storage
|
No encryption
|
—
|
No public documentation of storage encryption found.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Local access uses one fixed 'admin' username; cloud control via a Shelly account.
|
| Authentication
|
Basic
|
—
|
Password protection of the local API is optional
|
| Brute-force protection
|
Basic
|
—
|
No public documentation found.
|
| Event logging
|
Partial logging
|
—
|
No public documentation of an access log found.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
By default Shelly devices allow unauthenticated local HTTP API access; a password must be set by the user.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Shelly Gen2 firmware (mJS scripting) (Companion App: Shelly Smart Control)
|
| Hardware (CPU / GPU)
|
CPU: ESP32-U4WDH • GPU: Not disclosed
|
| Memory & Storage
|
Memory: Not disclosed • Storage: Not disclosed
|
| Power, Battery & Charging
|
Battery: None • Power: 110–240 VAC / 24–48 VDC / 12 VDC ±10%, < 1.2 W • Charging: N/A
|
| Display & Camera
|
Display: None • Camera: None
|
| Sound & Connectivity
|
Sound: None • Connectivity: Wi-Fi 802.11 b/g/n, Bluetooth 4.2; 1 potential-free relay output, max load 16 A
|
| Physical (Dimensions & Mass)
|
Dimensions: Not disclosed • Mass: Not disclosed
|
The Shelly Plus 1 is a small Wi-Fi/Bluetooth relay running Shelly's Gen2 platform. No CVE was found for this model itself; related Gen2+ devices have had denial-of-service issues. The main weakness is that local access has no password by default, so users must enable authentication themselves. PositiveInitial classification of Shelly Plus 1 (SNSW-001X16EU)s are optional TLS support and a published security update commitment.
