Shelly Plus Uni (SNSN-0043X)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Assessment scope and uncertainty
Documentation assessment revised 24 October 2026. Scope is explicitly LIMITED to manufacturer factory-provisioned ESP32 production shipped with official firmware 2.0 or later, retaining its original security provisioning, current supported stock firmware, local administrator authentication enabled and HTTPS/WSS management. Optional plaintext integrations, MQTT without TLS, Modbus and debug RPC transports are excluded and must remain disabled in this profile. A firmware upgrade on an older unit does NOT establish this factory profile. The documents establish a manufacturer production policy; no individual serial number or exact model batch was inspected. Consequently this is a conditional documentation classification, not a certification of all units bearing this model number. No hardware test, flash dump or penetration test was performed.
The earlier legacy-unit storage assumption and resulting C scenario have been withdrawn. Storage is now tied to the manufacturer-documented factory-provisioned scope, not to an inference that an unverified older device is either encrypted or plaintext. Before applying this grade to a physical unit, confirm original provisioning with the vendor; otherwise storage and the total remain undetermined. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 maps the configurable API policy without enforced replacement/complexity; it does not allege that a particular user password is weak.
Device-specific findings
A compact low-voltage universal module with two solid-state outputs, digital inputs, pulse counting and optional external sensors. Exposed 40 x 21 x 7 mm PCB, wired sensor/output connections and a reset button. Without an additional enclosure, board and wiring access create particularly weak physical protection.
Its accessible integration points make enclosure security important. Sensor measurements and actuator commands require separate consideration. The current system documentation excludes this model from configuration backup and default-configuration functions because of flash-space limits.
Vulnerability evidence and applicability
Shared Gen2+ history: firmware 2.0.0 fixes an OTA authentication bypass. Exact affected builds for this model are not enumerated. This supports a platform-history judgment, not a confirmed model-specific CVE or an exploitable flaw in the assessed 2.0+ firmware.
No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model.
Score calculation
CRIS vector (website order): 3, 2, 1, 1, 2, 1, 1, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 2, User Authentication 2. Total 6; conditional documentation grade B.
This grade applies only to the stated factory security profile and configured channels. For an unidentified or legacy production batch, storage and the overall grade are not established. Similar totals across these models reflect common platform controls and category rounding, not independent measurements or proof of identical hardware security.
Practical improvements
Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade.
Date and research limits
Release date field: 2024-03-06 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: retailer record.
This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence.
Sources
- Exact-model identification and physical interfaces
- Model API and supported components
- WikiIoT methodology
- WikiIoT Classification form
- Shelly firmware update policy
- Shelly authentication
- Shelly HTTPS configuration
- Shelly RED security changes
- Shelly debug logs
- Shelly firmware changelog
- Shelly system configuration
- Shelly common device service / SetAuth
- Nozomi original CVE-2025-12056 advisory
- CVE Program record CVE-2025-12056
- ESP32 hardware flash encryption design
