| Shelly Wall Display X1i
|
|
Security Grade
Calculator v
|
Shelly Wall Display X1i
Release Date: 2026-07-25 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
No publicly documented hardware tampering incidents specifically involving the Shelly Wall Display X1i were identified in the reviewed sources. The device uses a wall-mounted enclosure and an interchangeable power base. The absence of published tampering incidents does not establish physical tamper resistance.
|
| Known vulnerabilities
|
None
|
🔗 Proof
|
No confirmed vulnerability specifically assigned to the Shelly Wall Display X1i was established in the reviewed public documentation. The device runs Android 11 and supports network connectivity and third-party integrations, so software vulnerabilities remain a relevant security consideration. Further review of security advisories, firmware versions and vulnerability databases is necessary.
|
| Prior attacks
|
None
|
🔗 Proof
|
No publicly confirmed cyberattack specifically targeting the Shelly Wall Display X1i was established in the reviewed sources. Its Wi-Fi, Bluetooth, MQTT and smart home integration capabilities create network-facing functionality that should be assessed through authorized security testing. The lack of documented attacks does not mean the device is immune to attack.
|
| Updatability
|
Very common
|
🔗 Proof
|
The Shelly Wall Display X1i supports over-the-air firmware updates. Shelly confirmed that firmware version 2.8.0 introduced Matter controller and device functionality for the X1i through a free OTA update. The device therefore has a documented mechanism for receiving firmware improvements and security-related updates without hardware replacement.
|
| Category Score
|
Score: 1 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
The Shelly Wall Display X1i supports Matter controller and device functionality through firmware 2.8.0. According to Shelly, the panel obtains its Matter device credentials from Shelly during a dedicated setup step and does not expose itself to other Matter systems until the process has been completed. This provides a documented credential-based onboarding mechanism for Matter integration. Authentication for other interfaces must be evaluated separately.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
The Shelly Wall Display X1i supports the Matter protocol, which provides authenticated and encrypted communications between commissioned devices. The device also supports Wi-Fi, Bluetooth, MQTT, webhooks and local network control. The reviewed documentation does not establish that encryption is mandatory for every supported communication method. The secure communication rating therefore applies to properly configured Matter sessions rather than all possible interfaces.
|
| Storage
|
No encryption
|
🔗 Proof
|
The Shelly Wall Display X1i contains 8 GB of internal flash storage and runs Android 11. However, the manufacturer's published hardware specifications do not establish whether full-disk encryption, file-based encryption or hardware-backed key storage is enabled on this particular device. Storage encryption cannot be conclusively classified without further technical evidence.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The Shelly Wall Display X1i can be managed through its local interface and the Shelly Smart Control ecosystem. The device provides authentication settings for its web interface, while account-based management is available through Shelly services. However, comprehensive device-local role-based access control and multiple independent user roles have not been established from the reviewed documentation.
|
| Authentication
|
Basic
|
🔗 Proof
|
Shelly's Wall Display web interface documentation describes an optional authentication setting. When enabled, the user must enter a configured password to access the web interface. This provides password-based authentication, but the documentation does not establish mandatory authentication across every device interface or multi-factor authentication for local access.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Shelly's authentication documentation describes brute-force protection using failed-login tracking and progressive backoff delays. However, this mechanism has not been independently verified on the Shelly Wall Display X1i. Basic protection is assigned provisionally, pending confirmation of the installed firmware's behavior.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Shelly documentation confirms that Wall Display devices generate operational events, input and output status, sensor readings and system information, including firmware version and uptime. The platform also provides information about connectivity and configuration. However, the reviewed documentation does not demonstrate comprehensive security audit logging of authentication attempts, administrative access or configuration changes. Partial logging is therefore a provisional assessment.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Local authentication is disabled by default and becomes active when the user configures a device password. Shelly encourages users to enable authentication, but mandatory password changes after initial setup and password complexity enforcement have not been established. The selected rating is a provisional approximation of the default authentication posture, not evidence of a known weak default password.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Android 11 (Companion App: Shelly Smart Control)
|
| Hardware (CPU / GPU)
|
CPU: Rockchip RK3326-S, Quad-core ARM Cortex-A35, 1.5 GHz • GPU: Integrated GPU (model not specified in official product documentation)
|
| Memory & Storage
|
Memory: 1 GB RAM • Storage: 8 GB Flash
|
| Power, Battery & Charging
|
Battery: None (externally powered) • Power: 100–240 V AC, 50/60 Hz; USB-C 5 V DC, 1 A; power consumption below 5 W • Charging: Not applicable
|
| Display & Camera
|
Display: 4-inch color capacitive touchscreen, 720 × 720 pixels, 5-point multi-touch • Camera: None
|
| Sound & Connectivity
|
Sound: Integrated 1 W speaker and microphone; Bluetooth and Sonos speaker support • Connectivity: Dual-band Wi-Fi 6 (2.4/5 GHz), Bluetooth 5.0, MQTT, local Wi-Fi, Matter (firmware 2.8.0 and later)
|
| Physical (Dimensions & Mass)
|
Dimensions: 86.5 × 86.5 × 35.7 mm (with power base); 86.5 × 86.5 × 11 mm (without power base) • Mass: 163 g (with power base); 113 g (without power base)
|
The Shelly Wall Display X1i is a wall-mounted smart home control panel manufactured by Shelly Group SE. The device was publicly available by July 2026 and was subsequently featured in Shelly's IFA 2026 product announcements on September 3, 2026.
It features a 4-inch 720 × 720 capacitive touchscreen, a Rockchip RK3326-S quad-core ARM Cortex-A35 processor operating at 1.5 GHz, 1 GB RAM, 8 GB flash storage, and Android 11.
The device supports dual-band Wi-Fi 6, Bluetooth 5.0, MQTT, local network control, Home Assistant integration, and Matter controller and device functionality through firmware 2.8.0.
Additional hardware includes a built-in 1 W speaker, microphone, light and proximity sensors, and an interchangeable power base with a 5 A relay. Power can be supplied through a 100–240 V AC power base or USB-C.
Security-related capabilities include configurable web interface authentication, Matter credential-based commissioning, and over-the-air firmware updates. Operational event and status information is generated by the device.
This assessment uses Shelly's official product specifications, technical documentation, and firmware announcements available as of October 23, 2026.
Some security characteristics remain unverified, including comprehensive local storage encryption, brute-force protection, password policy enforcement, and complete security audit logging. No confirmed model-specific hardware tampering incidents, vulnerabilities, or attacks were established from the reviewed sources.
Consequently, this evaluation should be treated as a preliminary, evidence-based security classification rather than the result of independent penetration testing.
