You do not have permission to edit this page, for the following reasons:
'''Assessment scope and uncertainty''' Documentation assessment revised 24 October 2026. Scope is explicitly LIMITED to manufacturer factory-provisioned ESP32 production shipped with official firmware 2.0 or later, retaining its original security provisioning, current supported stock firmware, local administrator authentication enabled and HTTPS/WSS management. Optional plaintext integrations, MQTT without TLS, Modbus and debug RPC transports are excluded and must remain disabled in this profile. A firmware upgrade on an older unit does NOT establish this factory profile. The documents establish a manufacturer production policy; no individual serial number or exact model batch was inspected. Consequently this is a conditional documentation classification, not a certification of all units bearing this model number. No hardware test, flash dump or penetration test was performed. The earlier legacy-unit storage assumption and resulting C scenario have been withdrawn. Storage is now tied to the manufacturer-documented factory-provisioned scope, not to an inference that an unverified older device is either encrypted or plaintext. Before applying this grade to a physical unit, confirm original provisioning with the vendor; otherwise storage and the total remain undetermined. Hardware scores interpret documented physical exposure, not measured incident frequency. Rare vulnerabilities means limited documented security history, not a statistical rate or low severity. None for prior attacks means no attributable in-the-wild incident identified in the reviewed material; a CVE or lab demonstration alone is not a botnet incident. Password score 3 maps the configurable API policy without enforced replacement/complexity; it does not allege that a particular user password is weak. '''Device-specific findings''' A DIN-rail smart switch with three independently controlled potential-free output circuits. DIN-rail enclosure with screw terminals, Ethernet and a tactile button that performs factory reset after 10 seconds. The three independent relay circuits remain physically accessible at the terminals. One administrator can affect three circuits. Use a protected electrical enclosure and restrict access to the local management interface. Potential-free contacts describe the electrical interface; they are not a cybersecurity control. '''Vulnerability evidence and applicability''' Shared Gen2+ history: firmware 2.0.0 fixes an OTA authentication bypass. Exact affected builds for this model are not enumerated. This supports a platform-history judgment, not a confirmed model-specific CVE or an exploitable flaw in the assessed 2.0+ firmware. No CVEs for Shelly TRV, Pro 4PM or the mobile application have been relabelled as confirmed vulnerabilities of this model. '''Score calculation''' CRIS vector (website order): 2, 2, 1, 1, 2, 1, 1, 2, 2, 1, 2, 3. Category ceilings: Device 2, System 2, User Authentication 2. Total 6; conditional documentation grade B. This grade applies only to the stated factory security profile and configured channels. For an unidentified or legacy production batch, storage and the overall grade are not established. Similar totals across these models reflect common platform controls and category rounding, not independent measurements or proof of identical hardware security. '''Practical improvements''' Verify model, installed firmware and support status; keep official firmware current. Set a unique administrator password, enable HTTPS with verified certificates, restrict management to a trusted network, disable unused integrations, protect physical access and enable appropriate diagnostic logging. Check storage protection against the actual production batch instead of inferring it from an upgrade. '''Date and research limits''' Release date field: 2022-09-13 is a retailer-reported PRODUCT-FAMILY reference, not a manufacturer-confirmed worldwide launch. Source: [https://www.digitec.ch/en/s1/product/shelly-pro-3-switch-actuator-actuator-22178066 retailer record]. This is an individual documentation-based course assessment. Course instructions require ten device classifications with supporting links; this text makes no claim of laboratory testing. Distinct model identifiers have been retained. The 120 A and 400 A meters are separate variants with substantially shared security evidence. '''Sources''' * [https://kb.shelly.cloud/knowledge-base/shelly-pro-3-v1 Exact-model identification and physical interfaces] * [https://shelly-api-docs.shelly.cloud/gen2/Devices/Gen2/ShellyPro3/ Model API and supported components] * [https://fehmijaafar.net/wiki-iot/index.php/Methodology WikiIoT methodology] * [https://fehmijaafar.net/wiki-iot/index.php/Form:Classification WikiIoT Classification form] * [https://shelly-api-docs.shelly.cloud/gen2/General/FirmwareUpdatePolicy/ Shelly firmware update policy] * [https://shelly-api-docs.shelly.cloud/gen2/General/Authentication/ Shelly authentication] * [https://shelly-api-docs.shelly.cloud/gen2/General/CustomHTTPSCertificates/ Shelly HTTPS configuration] * [https://us.shelly.com/blogs/documentation/kbuca-what-you-need-to-know-shelly-and-eu-red Shelly RED security changes] * [https://shelly-api-docs.shelly.cloud/gen2/General/DebugLogs/ Shelly debug logs] * [https://shelly-api-docs.shelly.cloud/gen2/changelog/ Shelly firmware changelog] * [https://shelly-api-docs.shelly.cloud/gen2/ComponentsAndServices/Sys/ Shelly system configuration] * [https://shelly-api-docs.shelly.cloud/gen2/ComponentsAndServices/Shelly/ Shelly common device service / SetAuth] * [https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-12056 Nozomi original CVE-2025-12056 advisory] * [https://www.cve.org/CVERecord?id=CVE-2025-12056 CVE Program record CVE-2025-12056] * [https://docs.espressif.com/projects/esp-idf/en/stable/esp32/security/flash-encryption.html ESP32 hardware flash encryption design]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
