diff --git a/addons/hw_posbox_homepage/controllers/main.py b/addons/hw_posbox_homepage/controllers/main.py
index 2951857fc3e..d5d6ebdbd95 100644
--- a/addons/hw_posbox_homepage/controllers/main.py
+++ b/addons/hw_posbox_homepage/controllers/main.py
@@ -64,7 +64,7 @@ class IoTboxHomepage(web.Home):
         mac = get_mac()
         h = iter(hex(mac)[2:].zfill(12))
         ssid = helpers.get_ssid()
-        wired = subprocess.check_output('cat /sys/class/net/eth0/operstate', shell=True).decode('utf-8').strip('\n')
+        wired = subprocess.check_output(['cat', '/sys/class/net/eth0/operstate']).decode('utf-8').strip('\n')
         if wired == 'up':
             network = 'Ethernet'
         elif ssid:
diff --git a/addons/hw_posbox_upgrade/controllers/main.py b/addons/hw_posbox_upgrade/controllers/main.py
index a376f4eee22..8c3b1331ec6 100644
--- a/addons/hw_posbox_upgrade/controllers/main.py
+++ b/addons/hw_posbox_upgrade/controllers/main.py
@@ -34,7 +34,7 @@ class PosboxUpgrader(hw_proxy.Proxy):
 
     @http.route('/hw_proxy/upgrade', type='http', auth='none', )
     def upgrade(self):
-        commit = subprocess.check_output("git --work-tree=/home/pi/odoo/ --git-dir=/home/pi/odoo/.git log -1", shell=True).decode('utf-8').replace("\n", "<br/>")
+        commit = subprocess.check_output(["git", "--work-tree=/home/pi/odoo/", "--git-dir=/home/pi/odoo/.git", "log", "-1"]).decode('utf-8').replace("\n", "<br/>")
         return upgrade_page_template.render({
             'title': "Odoo's IoTBox - Software Upgrade",
             'breadcrumb': 'IoT Box Software Upgrade',
diff --git a/addons/hw_proxy/controllers/main.py b/addons/hw_proxy/controllers/main.py
index f67babef3d0..797644a395d 100644
--- a/addons/hw_proxy/controllers/main.py
+++ b/addons/hw_proxy/controllers/main.py
@@ -127,7 +127,7 @@ class Proxy(http.Controller):
                 %s
                 </pre>
 
-            """ % subprocess.check_output('lsusb -v', shell=True).decode('utf-8')
+            """ % subprocess.check_output(['lsusb', '-v']).decode('utf-8')
 
         return request.make_response(resp,{
             'Cache-Control': 'no-cache',