Shelly smart home flaw fixed with firmware update

Convenience often shapes smart home design. The Shelly smart home flaw shows how that convenience can unintentionally expose devices after installation. Researchers discovered some units kept their setup Wi-Fi network active, allowing nearby people to connect locally even after configuration finished.

The company responded with a firmware update, but discussion continues over whether the behavior counted as a vulnerability or intended functionality.

What researchers found

Certain Gen4 Shelly devices continued broadcasting their configuration access point after setup. The network exists to help users connect during installation, yet it remained available longer than expected.

Anyone within wireless range could join the network and interact with the device interface. The access did not require internet exploitation or advanced tools. Physical proximity alone was enough.

Although this did not automatically grant full system control, it created a direct interaction path that normally should close after setup.

Company response and firmware update

Shelly stated the behavior was originally designed to simplify maintenance and deployment in environments where installers need repeated local access. Still, the company acknowledged potential misuse and prepared a firmware change.

The update introduces automatic shutdown rules:

• The setup network disables shortly after configuration
• The access point will not reactivate unless manually reset
• Unsecured connections time out if unused

These adjustments aim to preserve ease of installation while reducing unnecessary exposure.

Why the debate matters

Researchers classify the issue as a vulnerability because users reasonably expect setup networks to disappear automatically. Leaving them active increases the chance someone nearby connects without permission.

The disagreement highlights a recurring IoT problem. Features built for convenience can quietly become security risks when behavior is unclear during setup.

Many users never check post-installation network activity, assuming the device protects itself by default.

Real-world impact

The risk requires local presence, meaning neighbors, visitors, or anyone near the building could attempt access. In shared housing or office environments, this expands the potential exposure area significantly.

From the interface, a person could interact with smart lighting, automation rules, or connected appliances depending on configuration. Even limited access may reveal household patterns or allow unwanted control.

Smart homes rely on trust in invisible background processes, which makes unnoticed settings especially sensitive.

Conclusion

The Shelly smart home flaw illustrates how usability decisions influence security outcomes. A setup feature designed for convenience remained active longer than users expected, creating a local access opportunity.

The firmware update reduces that risk by automatically disabling the network after installation. The incident serves as a reminder that smart home protection depends not only on strong encryption but also on predictable device behavior after setup.