Shelly EM Mini Gen4 (S4EM-001PXCEU16)

Shelly EM Mini Gen4 (S4EM-001PXCEU16)
Security Grade B Calculator v1	Shelly EM Mini Gen4 (S4EM-001PXCEU16) Brand: Shelly Category: Miniature smart energy meter • Model / Gen: Gen4 S4EM-001PXCEU16 Release Date: 2025-10-13 • Status: Classification Date: 2026-10-24 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	P1 (P). Provisional absence-of-report estimate; model-specific tampering frequency is unknown. This choice does not prove tamper resistance.
Known vulnerabilities	Rare	🔗 Proof	I1 (I). Provisional type/platform-level interpretation; model-specific affected-version applicability and frequency are unverified. Not a model-specific CVE claim.
Prior attacks	None	🔗 Proof	P2 (P). Provisional absence-of-report estimate; model-specific attack frequency is unknown. This is not a claim that attacks never occurred.
Updatability	Very common	🔗 Proof	E1 (E). E1: common update-policy evidence; category choice is a qualitative interpretation.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	I2 (I). I2: Partial is an assessment interpretation, not a claim that every supported integration is equally protected.
Communications	Encrypted with up-to-date encryption	🔗 Proof	C1 (C). C1: applies only to the encrypted management configuration specified in the free text; optional unassessed integrations are excluded.
Storage	Encrypted with up-to-date encryption	🔗 Proof	C2 (C). C2: conditional manufacturing-profile estimate; actual unit and full storage coverage are unverified. Do not apply automatically to old stock.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	I3 (I). I3: Basic is the local-account assessment interpretation, independent of cloud-app sharing features.
Authentication	Basic	🔗 Proof	I4 (I). I4: conservative Basic assessment; the strongest authentication choice is not established by this review.
Brute-force protection	Exist	🔗 Proof	E2 (E). E2: assessed firmware condition applies; older installations require separate evaluation.
Event logging	Partial logging	🔗 Proof	I5 (I). I5: Partial is the assessment interpretation. The profile enables protected logs; full access-audit coverage remains unverified.
Passwords	Require change after setup	🔗 Proof	I6 (I). I6: approximate mapping of initial password creation to the form option; literal change-after-setup and enforced complexity are unverified.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Stock Shelly firmware; reference profile 2.0.0 or later supported stable release (Companion App: Shelly Smart Control (optional; cloud not assessed))
Hardware (CPU / GPU)	CPU: ESP-Shelly-C68F • GPU:
Memory & Storage	Memory: • Storage: 8 MB flash
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi/IP management; optional integrations excluded from assessed profile
Physical (Dimensions & Mass)	Dimensions: • Mass:

Provisional documentary assessment — 2026-10-24. A compact connected energy meter with a local network interface. Reference conditions: stock supported firmware 2.0.0+; completed setup; encrypted authenticated Wi-Fi/IP management with trusted certificates; protected diagnostic logging enabled; optional integration channels disabled or unused. No physical unit, installed build or manufacturing lot was inspected. Storage condition: the point estimate assumes a newly produced factory-provisioned unit meeting the manufacturer's protected-storage profile. This is unverified for an actual unit and does not establish complete storage coverage. Old stock requires reassessment. Evidence labels: E=documented capability, I=author interpretation, C=conditional configuration/manufacturing assumption, P=provisional absence-of-report estimate. P is not proof of no incidents; I is not a measured frequency. Point calculation: ceil(5/4)+ceil(4/3)+ceil(9/5)=2+2+2=6 (B, provisional). Allowing the unresolved entries D1/D2/D3/S3/U5 to range from 1 to 3 yields 5–7 (A− through C) under the remaining profile. No unique unconditional grade is established. Release-date scope: An administrator on the official Shelly community confirmed that the product was available in the Shelly store on this date. This is a documented shop-availability confirmation, not a verified worldwide first-sale date. Dated primary-source confirmation. Interpretation: Energy readings can reveal patterns of appliance use. Restrict access to telemetry and avoid exposing the device interface directly to the Internet. Source scope: WikiIoT method; proof links above are control documentation or research leads, not proof that missing incident reports imply immunity.