You do not have permission to edit this page, for the following reasons:
'''Assessment scope and uncertainty''' Documentation assessment revised 24 October 2026. Scope is explicitly LIMITED to manufacturer factory-provisioned ESP32 production shipped with official firmware 2.0 or later, retaining its original security provisioning, current supported stock firmware, local administrator authentication enabled and HTTPS/WSS management. Optional plaintext integrations, MQTT without TLS, Modbus and debug RPC transports are excluded and must remain disabled in this profile. A firmware upgrade on an older unit does NOT establish this factory profile. The documents establish a manufacturer production policy; no individual serial number or exact model batch was inspected. Consequently this is a conditional documentation classification, not a certification of all units bearing this model number. No hardware test, flash dump or penetration test was performed. The earlier legacy-unit storage assumption and resulting C scenario have been withdrawn. Storage is now tied to the manufacturer-documented factory-provisioned scope, not to an inference that an unverified older device is either encrypted or plaintext. Before applying this grade to a physical unit, confirm original provisioning with the vendor; otherwise storage and the total remain undetermined. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 maps the configurable API policy without enforced replacement/complexity; it does not allege that a particular user password is weak. '''Device-specific findings''' A DIN-rail three-phase energy meter for monitoring electrical consumption. The assessed product is the 120 A model, not the separately marketed V2 product. DIN-rail meter with accessible screw terminals, a proprietary serial add-on interface and a documented 10-second factory reset. A secured electrical cabinet is an external control. Consumption history can reveal occupancy patterns. Restrict access to exported measurements and keep optional Modbus services isolated. Do not confuse energy-measurement logs with authentication audit logs. '''Vulnerability evidence and applicability''' CVE-2025-12056 names Pro 3EM: an unauthenticated adjacent-network attacker can cause reboot/DoS (CVSS 4.0: 8.3). Nozomi lists versions below 1.4.4, while the CVE structured range includes 1.4.4. The advisory also leaves patch availability unclear. Do not certify 1.4.4 as fixed; confirm remediation with the vendor. Rare is frequency, not severity. See version discussion below. Primary advisory: [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-12056 Nozomi CVE-2025-12056]. The public CVE record contains a boundary inconsistency (<1.4.4 in prose versus <=1.4.4 in structured data). The reviewed manufacturer changelog does not explicitly tie a fixed release to this CVE. The 2.0+ profile is numerically later than both stated ranges, but this review has not independently verified remediation. Until vendor confirmation, isolate management access and restrict access from untrusted adjacent networks. No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model. '''Score calculation''' CRIS vector (website order): 2, 2, 1, 1, 2, 1, 1, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 2, User Authentication 2. Total 6; conditional documentation grade B. This grade applies only to the stated factory security profile and configured channels. For an unidentified or legacy production batch, storage and the overall grade are not established. Similar totals across these models reflect common platform controls and category rounding, not independent measurements or proof of identical hardware security. '''Practical improvements''' Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade. '''Date and research limits''' Release date field: 2023-01-17 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: [https://www.digitec.ch/en/s1/product/shelly-pro-3em-120a-energy-monitors-23999359 retailer record]. This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence. '''Sources''' * [https://kb.shelly.cloud/knowledge-base/shelly-pro-3em Exact-model identification and physical interfaces] * [https://shelly-api-docs.shelly.cloud/gen2/Devices/Gen2/ShellyPro3EM/ Model API and supported components] * [https://fehmijaafar.net/wiki-iot/index.php/Methodology WikiIoT methodology] * [https://fehmijaafar.net/wiki-iot/index.php/Form:Classification WikiIoT Classification form] * [https://shelly-api-docs.shelly.cloud/gen2/General/FirmwareUpdatePolicy/ Shelly firmware update policy] * [https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ Shelly authentication] * [https://shelly-api-docs.shelly.cloud/gen2/General/CustomHTTPSCertificates/ Shelly HTTPS configuration] * [https://us.shelly.com/blogs/documentation/kbuca-what-you-need-to-know-shelly-and-eu-red Shelly RED security changes] * [https://shelly-api-docs.shelly.cloud/gen2/General/DebugLogs/ Shelly debug logs] * [https://shelly-api-docs.shelly.cloud/gen2/changelog/ Shelly firmware changelog] * [https://shelly-api-docs.shelly.cloud/gen2/ComponentsAndServices/Sys/ Shelly system configuration] * [https://shelly-api-docs.shelly.cloud/gen2/ComponentsAndServices/Shelly/ Shelly common device service / SetAuth] * [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-12056 Nozomi original CVE-2025-12056 advisory] * [https://www.cve.org/CVERecord?id=CVE-2025-12056 CVE Program record CVE-2025-12056] * [https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/flash-encryption.html ESP32 hardware flash encryption design]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
