CVE-2025-11243

Executive Summary

CVE-2025-11243 is a critical vulnerability in the Shelly Pro 4PM smart relay device, specifically in firmware versions prior to v1.6. The flaw is an Allocation of Resources Without Limits or Throttling (CWE-770) that allows an unauthenticated attacker to cause an excessive allocation of resources via network requests, leading to a denial-of-service (DoS) condition. This vulnerability can be exploited remotely without authentication, making it a significant threat to IoT deployments using this device.

The vulnerability resides in the device's network stack, where incoming requests are not properly rate-limited or resource-constrained. An attacker can send a high volume of specially crafted packets, exhausting memory or CPU resources and causing the device to become unresponsive. This can disrupt critical infrastructure, home automation, or industrial control systems relying on the Shelly Pro 4PM.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary IoT device. The supply chain risk is limited to the device's firmware distribution channel; users must ensure they obtain firmware updates only from official Shelly sources to avoid tampered binaries.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0 (likely unassigned or placeholder), based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): None (N) – No data breach.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The ease of exploitation (no auth, low complexity) and potential for disrupting critical services make this a priority for patching.

Deep Dive & Mechanics

The Shelly Pro 4PM is a DIN-rail mounted smart relay with four channels, commonly used in building automation, lighting control, and energy monitoring. It runs a custom embedded Linux firmware with a web server for configuration and MQTT/CoAP for IoT communication.

The vulnerability is in the device's handling of incoming network connections. The firmware does not implement any form of resource throttling or connection limiting. An attacker can open multiple TCP connections or send a flood of UDP packets, causing the device to allocate memory for each connection without releasing it. This leads to:

1. Memory Exhaustion: The device's limited RAM (typically 64-128 MB) is consumed by connection tracking buffers.
2. CPU Saturation: The kernel's network stack spends excessive time managing the flood of connections.
3. Watchdog Timer Expiry: The device may crash or reboot, but the attack can be repeated.

The attack does not require any special payload; simple network flooding tools (e.g., hping3, nmap, or custom scripts) can trigger the condition.

Vulnerable vs. Patched Code

Since this is a proprietary firmware, source code is not publicly available. However, the fix in v1.6 likely involves:

• Rate Limiting: Implementing iptables or nftables rules to limit incoming connections per IP.
• Connection Tracking Limits: Reducing the maximum number of concurrent connections in the kernel (net.netfilter.nf_conntrack_max).
• Memory Quotas: Setting per-process memory limits using ulimit or cgroups.

Vulnerable Behavior (pre-v1.6):

// Pseudo-code: No limits on accept()
while(1) {
    client = accept(server_fd, ...);
    // No check on number of clients
    handle_client(client);
}

Patched Behavior (v1.6+):

// Pseudo-code: With connection limit
#define MAX_CLIENTS 100
int client_count = 0;
while(1) {
    if (client_count >= MAX_CLIENTS) {
        sleep(1);
        continue;
    }
    client = accept(server_fd, ...);
    client_count++;
    handle_client(client);
    client_count--;
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Shelly Pro 4PM with firmware < v1.6 on the same network.
• Attacker machine with network access (e.g., Kali Linux).

Exploitation Steps:

1. Identify Target: Use nmap to scan for Shelly devices on port 80 or 443.

   nmap -p 80,443 --open 192.168.1.0/24
   

2. Launch DoS Attack: Use hping3 to flood the device with SYN packets.

   hping3 -S --flood -V -p 80 192.168.1.100
   

3. Verify Impact: The device web interface becomes unresponsive. Physical relays may stop responding to commands.

Alternative Method (UDP Flood):

hping3 --udp --flood -p 1234 192.168.1.100

Note: No public exploit code exists for this CVE. The above is a generic DoS technique.

Blue Team (Defensive)

Detection:

• Monitor for sudden spikes in network traffic to Shelly devices.
• Use SNMP or device logs to detect high CPU/memory usage.

Mitigation:

• Isolate Shelly devices on a separate VLAN with strict firewall rules.
• Implement rate limiting at the network perimeter (e.g., iptables).
• Monitor device health via heartbeat pings.

Lab Setup for Testing:

1. Set up a Shelly Pro 4PM in a sandboxed network.
2. Use a traffic generator (e.g., mz or scapy) to simulate the attack.
3. Observe device behavior via serial console or web interface.

Indicators of Compromise (IOCs)

• Network Traffic:

  • High volume of SYN packets to port 80/443 from a single IP.
  • UDP flood to random high ports.
  • Unusually high number of half-open connections (SYN_RECV state).

• Device Logs:

  • Kernel OOM (Out-of-Memory) messages.
  • Watchdog timer resets.
  • nf_conntrack: table full, dropping packet errors.

• File System:

  • /var/log/messages containing connection drop entries.
  • /proc/meminfo showing low free memory.

Detection Engineering

YARA Rule

rule CVE_2025_11243_DoS_Flood {
    meta:
        description = "Detects network traffic patterns associated with CVE-2025-11243 DoS attack on Shelly Pro 4PM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11243"
    strings:
        $syn_flood = { 08 00 45 00 00 2C 00 00 40 00 40 06 [4] 02 00 00 02 02 00 00 01 00 50 00 50 00 00 00 00 00 00 00 00 50 02 20 00 [4] 00 00 }
        $udp_flood = { 08 00 45 00 00 1C 00 00 40 00 40 11 [4] 02 00 00 02 02 00 00 01 [4] [4] 00 0C [2] }
    condition:
        any of them
}

Sigma Rule

title: Shelly Pro 4PM DoS Attack Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects excessive network connections to Shelly Pro 4PM devices indicative of CVE-2025-11243 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: [80, 443]
        dest_ip: 
            - "192.168.1.0/24"  # Adjust to Shelly subnet
        event_type: "flow"
        flow_state: "new"
    condition: selection | count() by dest_ip > 1000 within 60s
falsepositives:
    - Legitimate high traffic from multiple clients
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 80,443 (msg:"CVE-2025-11243 Shelly Pro 4PM DoS Attempt"; flow:to_server; flags:S; threshold: type both, track by_src, count 100, seconds 10; sid:1000001; rev:1;)
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-11243 Shelly Pro 4PM UDP Flood"; threshold: type both, track by_src, count 500, seconds 10; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Firmware: Upgrade all Shelly Pro 4PM devices to firmware version 1.6 or later. Download from official Shelly website.
2. Network Segmentation: Place Shelly devices on a dedicated VLAN with strict ACLs.
3. Rate Limiting: Apply ingress rate limiting on the switch port connecting the device.
4. Disable Unused Services: If not required, disable web interface and MQTT.

Long-Term Measures:

• Implement network monitoring for anomalous traffic patterns.
• Use a firewall to whitelist only trusted IPs for device management.
• Regularly audit firmware versions and apply patches promptly.

Workaround (if patching is delayed):

• Use iptables on a gateway to limit connections:

  iptables -A FORWARD -d 192.168.1.100 -p tcp --dport 80 -m connlimit --connlimit-above 10 -j DROP
  

Valters IT