CVE-2023-42144

Executive Summary

CVE-2023-42144 exposes a critical security flaw in the Shelly TRV (Thermostatic Radiator Valve) smart home device, specifically in firmware version 2.1.8 (build 20220811-15234). The vulnerability allows a local attacker with network access to the device during its initial setup phase to capture the Wi-Fi network password transmitted in cleartext. This occurs because the device does not enforce encryption (e.g., TLS/SSL) for the initial configuration communication, exposing sensitive credentials to anyone monitoring the local network traffic.

This vulnerability is particularly dangerous in smart home environments where the Wi-Fi password often grants access to the entire home network, potentially enabling lateral movement to other IoT devices, computers, and sensitive data. The lack of a known patch or vendor advisory at the time of analysis means all Shelly TRV devices running this firmware version remain at risk.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a physical IoT device. The supply chain risk lies in the device's manufacturing and distribution; end-users may receive devices with vulnerable firmware pre-installed. No open-source package dependencies are involved.

CVSS Breakdown & Threat Level

The NVD CVSS score is 0.0, indicating that the NVD has not yet assigned a score. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Adjacent Network (A) – The attacker must be on the same local network as the Shelly TRV.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond normal setup.
• Scope (S): Unchanged (U) – The impact is confined to the device and the Wi-Fi credential.
• Confidentiality (C): High (H) – The Wi-Fi password is exposed, which can lead to full network compromise.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The ease of exploitation (passive sniffing) and the high impact (network compromise) make this a critical threat for smart home environments.

Deep Dive & Mechanics

The Shelly TRV is an IoT device that controls radiator valves. During initial setup, a user typically connects to the device's own Wi-Fi access point (AP) to configure it. The device then prompts the user to enter the home Wi-Fi network's SSID and password. This communication occurs over a plain HTTP connection (port 80) without any encryption.

Attack Flow:

1. The attacker positions themselves within Wi-Fi range of the target Shelly TRV.
2. The attacker uses a Wi-Fi adapter in monitor mode and a tool like airodump-ng or tshark to capture all wireless traffic.
3. When the victim performs the initial setup (or resets the device and reconfigures it), the Shelly TRV sends an HTTP POST request containing the Wi-Fi credentials in cleartext.
4. The attacker captures this packet and extracts the Wi-Fi password.

Technical Detail: The vulnerable endpoint is likely /settings/sta or similar, where the device sends ssid and key (password) parameters in plaintext. The firmware version 2.1.8 (20220811-15234) does not implement HTTPS for this critical operation.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior.

Vulnerable (Firmware 2.1.8): The device's web server listens on HTTP port 80. During setup, the client sends a POST request to /settings/sta with the Wi-Fi credentials in plaintext.

POST /settings/sta HTTP/1.1
Host: 192.168.33.1
Content-Type: application/x-www-form-urlencoded

ssid=MyHomeWiFi&key=SuperSecretPassword123

Patched (Hypothetical): A patched firmware would enforce HTTPS for all configuration endpoints. The same request would be sent over TLS:

POST /settings/sta HTTP/1.1
Host: 192.168.33.1
Content-Type: application/x-www-form-urlencoded

ssid=MyHomeWiFi&key=SuperSecretPassword123

(Note: The content would be encrypted by TLS, making it unreadable to an attacker.)

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• One Shelly TRV device (firmware 2.1.8)
• A laptop with Kali Linux and a Wi-Fi adapter supporting monitor mode (e.g., Alfa AWUS036ACH)
• A smartphone or laptop to act as the victim performing the setup

Steps:

1. Enable monitor mode on the Wi-Fi adapter:

   sudo airmon-ng start wlan0
   

2. Capture traffic on the channel used by the Shelly TRV's AP (usually channel 1, 6, or 11):

   sudo airodump-ng -c 6 --bssid <Shelly_MAC> -w capture wlan0mon
   

3. The victim connects to the Shelly TRV's AP (e.g., "ShellyTRV-XXXX") and opens a browser to http://192.168.33.1.
4. The victim enters the home Wi-Fi credentials and clicks "Save".
5. The attacker stops the capture and analyzes the pcap file:

   tshark -r capture-01.cap -Y "http.request.method == POST" -T fields -e http.file_data
   

6. The output will reveal the Wi-Fi password in cleartext.

Alternative Tool: Use bettercap with the http.proxy module to intercept and log HTTP requests.

Blue Team (Defense & Detection)

Defensive Measures:

• Network Segmentation: Place IoT devices on a separate VLAN with strict firewall rules. This limits the impact of a Wi-Fi password leak.
• Firmware Updates: Monitor the Shelly vendor website for firmware updates. If a patch is released, apply it immediately.
• Manual Configuration: Use the Shelly mobile app (which may use Bluetooth for initial setup) instead of the web interface, if available.
• Wi-Fi Password Rotation: Regularly change the Wi-Fi password, especially after any new IoT device setup.

Detection:

• Monitor for HTTP POST requests to /settings/sta from unknown devices.
• Alert on cleartext transmission of sensitive keywords like ssid and key in HTTP traffic.

Indicators of Compromise (IOCs)

• Network Traffic:
  • HTTP POST requests to /settings/sta containing ssid and key parameters.
  • Source IP: 192.168.33.1 (Shelly TRV default IP)
  • Destination IP: Any client IP on the local network.
• Device Behavior:
  • Shelly TRV broadcasting an open Wi-Fi AP named "ShellyTRV-XXXX" (where XXXX is a random suffix).
  • Device firmware version string: 20220811-15234 v.2.1.8
• File Artifacts:
  • PCAP files containing HTTP POST requests with cleartext credentials.

Detection Engineering

YARA Rule

rule CVE_2023_42144_Shelly_TRV_Credential_Leak {
    meta:
        description = "Detects cleartext Wi-Fi credential transmission from Shelly TRV devices"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2023-42144"
    strings:
        $http_post = "POST /settings/sta HTTP/1.1"
        $ssid_key = "ssid="
        $key_param = "&key="
    condition:
        $http_post and $ssid_key and $key_param
}

Sigma Rule

title: Cleartext Wi-Fi Credential Transmission from Shelly TRV
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to Shelly TRV devices containing cleartext Wi-Fi credentials
author: Valters IT
date: 2024/01/01
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        http.method: 'POST'
        http.url: '/settings/sta'
        http.request_body|contains: 'ssid='
        http.request_body|contains: '&key='
    condition: selection
falsepositives:
    - Legitimate initial setup by authorized users
level: high
tags:
    - attack.credential_access
    - attack.t1552.001
    - cve.2023.42144

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-42144 Shelly TRV Cleartext Wi-Fi Credential Leak"; flow:to_server; content:"POST"; http_method; content:"/settings/sta"; http_uri; content:"ssid="; http_client_body; content:"&key="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Device: Place the Shelly TRV on a separate VLAN or guest network that does not have access to sensitive systems.
2. Disable Wi-Fi Setup: If possible, use the Shelly mobile app (which may use Bluetooth) for configuration instead of the web interface.
3. Monitor Network Traffic: Use the provided Sigma/Suricata rules to detect any exploitation attempts.

Long-Term Fix:

• Vendor Patch: Contact Shelly support and request a firmware update that enforces HTTPS for all configuration endpoints. As of this report, no patch is available.
• Replace Device: If the vendor does not provide a patch, consider replacing the Shelly TRV with a device that supports encrypted initial setup.

Workaround:

• Manual DNS/Proxy: Configure a local DNS server to redirect http://192.168.33.1 to a local HTTPS proxy that can encrypt the traffic, though this is complex and not recommended for average users.

Valters IT