You do not have permission to edit this page, for the following reasons:
'''Assessment scope and uncertainty''' Documentation assessment revised 24 October 2026. Scope is explicitly LIMITED to manufacturer factory-provisioned ESP32 production shipped with official firmware 2.0 or later, retaining its original security provisioning, current supported stock firmware, local administrator authentication enabled and HTTPS/WSS management. Optional plaintext integrations, MQTT without TLS, Modbus and debug RPC transports are excluded and must remain disabled in this profile. A firmware upgrade on an older unit does NOT establish this factory profile. The documents establish a manufacturer production policy; no individual serial number or exact model batch was inspected. Consequently this is a conditional documentation classification, not a certification of all units bearing this model number. No hardware test, flash dump or penetration test was performed. The earlier legacy-unit storage assumption and resulting C scenario have been withdrawn. Storage is now tied to the manufacturer-documented factory-provisioned scope, not to an inference that an unverified older device is either encrypted or plaintext. Before applying this grade to a physical unit, confirm original provisioning with the vendor; otherwise storage and the total remain undetermined. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 maps the configurable API policy without enforced replacement/complexity; it does not allege that a particular user password is weak. '''Device-specific findings''' A Wi-Fi and Bluetooth LED controller supporting RGBW, RGB and independent white-light profiles with power measurement. Small plastic in-wall module with accessible screw terminals and four control/output channels. Protection depends on the installation enclosure; the reviewed specification does not establish a tamper-resistant boundary. Unauthorised profile or script changes can affect several lighting channels. Limit integration credentials and physical access. Like Plus Uni, this model is excluded from the documented configuration-backup functions; lack of this feature does not establish a lack of firmware updates. '''Vulnerability evidence and applicability''' Shared Gen2+ history: firmware 2.0.0 fixes an OTA authentication bypass. Exact affected builds for this model are not enumerated. This supports a platform-history judgment, not a confirmed model-specific CVE or an exploitable flaw in the assessed 2.0+ firmware. No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model. '''Score calculation''' CRIS vector (website order): 2, 2, 1, 1, 2, 1, 1, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 2, User Authentication 2. Total 6; conditional documentation grade B. This grade applies only to the stated factory security profile and configured channels. For an unidentified or legacy production batch, storage and the overall grade are not established. Similar totals across these models reflect common platform controls and category rounding, not independent measurements or proof of identical hardware security. '''Practical improvements''' Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade. '''Date and research limits''' Release date field: 2024-03-15 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: [https://www.digitec.ch/en/s1/product/shelly-plus-rgbw-pm-dimming-actuator-actuator-43660738 retailer record]. This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence. '''Sources''' * [https://kb.shelly.cloud/knowledge-base/shelly-plus-rgbw-pm Exact-model identification and physical interfaces] * [https://shelly-api-docs.shelly.cloud/gen2/Devices/Gen2/ShellyPlusRGBWPM/ Model API and supported components] * [https://fehmijaafar.net/wiki-iot/index.php/Methodology WikiIoT methodology] * [https://fehmijaafar.net/wiki-iot/index.php/Form:Classification WikiIoT Classification form] * [https://shelly-api-docs.shelly.cloud/gen2/General/FirmwareUpdatePolicy/ Shelly firmware update policy] * [https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ Shelly authentication] * [https://shelly-api-docs.shelly.cloud/gen2/General/CustomHTTPSCertificates/ Shelly HTTPS configuration] * [https://us.shelly.com/blogs/documentation/kbuca-what-you-need-to-know-shelly-and-eu-red Shelly RED security changes] * [https://shelly-api-docs.shelly.cloud/gen2/General/DebugLogs/ Shelly debug logs] * [https://shelly-api-docs.shelly.cloud/gen2/changelog/ Shelly firmware changelog] * [https://shelly-api-docs.shelly.cloud/gen2/ComponentsAndServices/Sys/ Shelly system configuration] * [https://shelly-api-docs.shelly.cloud/gen2/ComponentsAndServices/Shelly/ Shelly common device service / SetAuth] * [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-12056 Nozomi original CVE-2025-12056 advisory] * [https://www.cve.org/CVERecord?id=CVE-2025-12056 CVE Program record CVE-2025-12056] * [https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/flash-encryption.html ESP32 hardware flash encryption design]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
