Shelly Pro 3EM (SPEM-003CEBEU)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Provisional: no qualifying model-specific hardware-tampering case was identified in the reviewed sources. Physical access remains a risk. The product documentation identifies the device; it does not prove the absence of incidents.
Known vulnerabilities	Rare	🔗 Proof	Provisional platform-history proxy based on documented security fixes. Model-specific vulnerability frequency has not been established. This is not a model-specific CVE count or evidence of a currently unpatched vulnerability.
Prior attacks	None	🔗 Proof	Provisional: no qualifying model-specific attack incident was identified in the reviewed sources. This does not establish that no attack has ever occurred. The product page provides device context, not proof of zero incidents.
Updatability	Very common	🔗 Proof	The assessed platform is eligible for firmware updates under the manufacturer's policy. This assessment assumes continued support and availability of the relevant firmware for the exact model.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Authentication is documented, but coverage differs across interfaces and integrations. Channel-specific exceptions prevent a Full classification.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Conditional on configured HTTPS with certificate validation and unused plaintext integrations disabled. This is an assessed configuration, not a claim that all default communications are encrypted. Older upgraded units may require certificate configuration.
Storage	Encrypted with up-to-date encryption	🔗 Proof	Conditional on a newly produced, factory-provisioned unit with the documented protection of security secrets. Encryption of all measurement history, scripts and other stored data is not established. Older units must not be assumed to gain factory flash encryption through a firmware update.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Local authentication uses the fixed administrator username admin. Full multi-user account and role management is not established.
Authentication	Secure	🔗 Proof	SHA-256 digest authentication is documented. This classification assumes authentication is enabled and used over correctly configured HTTPS with a unique administrator password.
Brute-force protection	Exist	🔗 Proof	Progressive authentication backoff is documented for firmware 2.0 and later. This classification is conditional on that firmware being available and installed on the exact model.
Event logging	Partial logging	🔗 Proof	Diagnostic logging is documented. Mapping it to Partial logging is an assessor interpretation; complete authentication and access-event auditing has not been confirmed. Energy-measurement history is not an authentication audit log.
Passwords	Require change after setup with complexity requirements	🔗 Proof	Approximate mapping of the documented initial credential-setup requirement. It does not establish forced password rotation after setup. Password complexity enforcement has not been confirmed.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Official Shelly Gen2 firmware; assessed under a firmware 2.0+ scenario (Companion App: Shelly Smart Control (optional))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass:

This assessment covers the Shelly Pro 3EM (SPEM-003CEBEU), a DIN-rail three-phase energy meter with 120 A current transformers. It does not cover the separately marketed V2 product.

Assessment date: 23 October 2026.

This is a documentation-based assessment. No physical device inspection or penetration testing was performed.

The assessment assumes a newly produced, factory-provisioned unit with official firmware 2.0 or later available for the exact model, enhanced security enabled, correctly configured HTTPS with certificate validation, a unique administrator password, and unused plaintext integrations disabled. These are assessment conditions, not verified observations of an individual device.

Older units upgraded to firmware 2.0 must not be assumed to gain factory flash encryption. The storage assessment refers to documented protection of security secrets. Encryption of all measurement history, scripts and other stored data has not been established.

Several classifications are provisional or interpretive. The available form has no Unknown option. None for hardware tampering and prior attacks means that no qualifying model-specific case was identified in the limited reviewed source set; it does not mean that zero incidents have been proven. The product page is identification evidence, not evidence of the absence of attacks.

Rare for known vulnerabilities is a cautious proxy based on platform security-fix history. It is not a quantified model-specific vulnerability frequency, a model-specific CVE count, or evidence of an unpatched vulnerability.

Partial logging is an approximate mapping of documented diagnostic logging. Complete authentication and access-event auditing remains unconfirmed. Energy-measurement history should not be confused with authentication audit logs.

The password classification approximates the documented initial credential-setup requirement. It does not demonstrate forced password rotation after setup, and complexity enforcement remains unconfirmed. These provisional and approximate mappings require reviewer acceptance.

The release date of 2023-01-17 is a retailer-reported product-family date: https://www.digitec.ch/en/s1/product/shelly-pro-3em-120a-energy-monitors-23999359 It has not been confirmed as the worldwide launch date of this exact hardware revision.

Consumption history can reveal occupancy patterns. Access to exported measurements should be restricted, and optional Modbus services should remain isolated.

Under the stated assumptions and provisional mappings, the proposed IDRS calculation is Device 2, System 2, User Authentication 2, total 6, corresponding to grade B. This is a conditional assessment result, not an unconditional security certification.