CVE-2024-48776

Executive Summary

CVE-2024-48776 is a vulnerability in the Shelly smart home ecosystem, specifically within the com.home.shelly Android application version 1.0.4. The issue allows a remote attacker to obtain sensitive information during the firmware update process. This could lead to exposure of device credentials, network configuration, or other private data transmitted without proper encryption or authentication. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the potential impact on smart home security is significant. No public exploit code or proof-of-concept is currently available, and the vendor has not confirmed a patch.

Supply Chain & Package Security

This vulnerability affects the Shelly mobile application, which is distributed through official app stores. Users should verify the integrity of the application and ensure they are not using modified or sideloaded versions. The firmware update process may involve communication with Shelly cloud servers; any interception or manipulation of this channel could compromise the entire device fleet.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (unassigned)
• Attack Vector: Network (remote)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium (due to lack of exploit and patch, but high potential for information disclosure)

Deep Dive & Mechanics

The vulnerability resides in the firmware update mechanism of the Shelly mobile application. During the update process, the application communicates with remote servers to download new firmware. The flaw likely involves:

• Unencrypted transmission of device identifiers, tokens, or network credentials.
• Lack of certificate validation allowing man-in-the-middle attacks.
• Exposure of API endpoints that reveal sensitive device information.

An attacker on the same network or with the ability to intercept traffic (e.g., via compromised router) could capture this data and use it to gain unauthorized access to Shelly devices or the user's home network.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the firmware update handler of com.home.shelly version 1.0.4. A secure implementation would:

• Use HTTPS with strict certificate pinning.
• Encrypt all sensitive data in transit.
• Authenticate the firmware source before download.

Exploitation & Lab Setup

Red Team

Since no public exploit exists, a red team would need to:

1. Set up a man-in-the-middle proxy (e.g., Burp Suite, mitmproxy) on the same network as the Shelly device.
2. Monitor traffic during a firmware update triggered from the app.
3. Capture and analyze HTTP requests/responses for exposed credentials or tokens.
4. Attempt to replay captured data to gain unauthorized access.

Example mitmproxy script to log requests:

from mitmproxy import http

def request(flow: http.HTTPFlow) -> None:
    if "firmware" in flow.request.pretty_url:
        print(f"URL: {flow.request.pretty_url}")
        print(f"Headers: {flow.request.headers}")
        print(f"Body: {flow.request.text}")

Blue Team

• Monitor network traffic for unusual outbound connections from Shelly devices.
• Use IDS/IPS rules to detect unencrypted firmware update attempts.
• Enforce network segmentation to isolate IoT devices from critical systems.
• Regularly audit app permissions and update mechanisms.

Indicators of Compromise (IOCs)

• Network traffic to unencrypted HTTP endpoints during firmware updates.
• Unexpected firmware versions or update requests from unknown IPs.
• Log entries showing failed certificate validation or SSL errors in the app.
• File hashes of modified or sideloaded versions of com.home.shelly.

Detection Engineering

YARA Rule

rule CVE_2024_48776_Shelly_Firmware_Leak {
    meta:
        description = "Detects potential sensitive data exposure in Shelly firmware update traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48776"
    strings:
        $s1 = "firmware" nocase
        $s2 = "token" nocase
        $s3 = "password" nocase
        $s4 = "device_id" nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Shelly Firmware Update Sensitive Data Exposure
id: 8f9a2b1c-3d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects unencrypted transmission of sensitive data during Shelly firmware update
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 80
        Image|endswith: '\\com.home.shelly.exe'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate firmware updates over HTTP (if any)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2024-48776 Shelly Firmware Update Sensitive Data Leak"; flow:to_server; content:"firmware"; nocase; content:"token"; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediately disable automatic firmware updates until a patch is released.
• Use a VPN or encrypted tunnel for all IoT device communication.
• Monitor Shelly's official channels for a security update.
• Consider replacing the device if no patch is provided within a reasonable timeframe.
• Report the vulnerability to Shelly support if not already acknowledged.

Valters IT