CVE-2025-12056

Executive Summary

CVE-2025-12056 is an out-of-bounds read vulnerability in the Shelly Pro 3EM energy meter, affecting firmware versions prior to 1.4.4. This flaw allows an attacker to overread buffers, potentially leaking sensitive memory contents. The vulnerability is classified as an Out-of-bounds Read (CWE-125) and is currently unpatched in older firmware versions. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the device's role in critical infrastructure monitoring, the risk of information disclosure remains significant.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the firmware of a hardware device (Shelly Pro 3EM). No supply chain package security implications are present.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability type (out-of-bounds read), a reasonable vector would be:

• Attack Vector (AV): Network (N) – likely exploitable over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – potential memory leak.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Estimated Base Score: 7.5 (High)

Threat Level: High – due to potential for sensitive data leakage from device memory.

Deep Dive & Mechanics

The Shelly Pro 3EM is a three-phase energy meter with network connectivity. The vulnerability resides in the firmware's handling of certain network requests or internal data processing, where a buffer is read beyond its allocated boundary. This out-of-bounds read can occur when the device processes malformed or oversized input, causing it to read adjacent memory regions.

Root Cause: Improper bounds checking in the firmware's input validation logic. When the device receives a request that exceeds expected buffer sizes, it fails to truncate or reject the input, leading to a read operation that accesses memory outside the intended buffer.

Impact: An attacker can trigger this vulnerability to read arbitrary memory contents, which may include:

• Cryptographic keys
• Session tokens
• Configuration data
• Other sensitive information stored in the device's memory

Attack Vector: The vulnerability is exploitable over the network, likely via HTTP or MQTT interfaces exposed by the device. No authentication is required, making it accessible to any network attacker.

Vulnerable vs. Patched Code

Since no specific code snippets are available, the following is a conceptual comparison:

Vulnerable Code (before v1.4.4):

void process_request(char *input, int input_len) {
    char buffer[256];
    // No bounds check
    memcpy(buffer, input, input_len);
    // Process buffer...
}

Patched Code (v1.4.4 and later):

void process_request(char *input, int input_len) {
    char buffer[256];
    if (input_len > sizeof(buffer)) {
        // Reject oversized input
        return;
    }
    memcpy(buffer, input, input_len);
    // Process buffer...
}

The patch adds a bounds check to ensure input_len does not exceed the buffer size, preventing the out-of-bounds read.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Shelly Pro 3EM device with firmware version < 1.4.4.
2. Connect the device to an isolated network with a Kali Linux attacker machine.
3. Identify the device's IP address (e.g., via ARP scan).

Exploitation Steps: Since no public exploit exists, a custom script can be developed to send oversized requests to the device's HTTP or MQTT endpoints. Example using Python:

import socket

target_ip = "192.168.1.100"
target_port = 80

# Craft a request with oversized payload
payload = b"A" * 1000  # Exceeds expected buffer size
request = b"GET /" + payload + b" HTTP/1.1\r\nHost: " + target_ip.encode() + b"\r\n\r\n"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(request)
response = sock.recv(4096)
print(response)
sock.close()

Expected Outcome: The device may respond with memory contents in the response or crash, revealing sensitive data.

Blue Team

Detection:

• Monitor for unusually large HTTP requests or MQTT messages to the Shelly device.
• Use network intrusion detection systems (NIDS) to flag oversized payloads.

Hunting:

• Search logs for repeated connection attempts with large payload sizes.
• Check device memory dumps for signs of buffer overread.

Mitigation:

• Immediately upgrade firmware to version 1.4.4 or later.
• Restrict network access to the device using firewall rules.
• Disable unnecessary services (e.g., MQTT if not used).

Indicators of Compromise (IOCs)

• Network Traffic: HTTP requests with payloads exceeding 256 bytes to the Shelly device.
• Device Behavior: Unexpected crashes or reboots of the Shelly Pro 3EM.
• Memory Dumps: Presence of sensitive data (e.g., keys) in network responses.
• Logs: Entries indicating buffer overflow errors or memory access violations.

Detection Engineering

YARA Rule

rule CVE_2025_12056_Shelly_Pro_3EM_Overread {
    meta:
        description = "Detects out-of-bounds read attempts on Shelly Pro 3EM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12056"
    strings:
        $s1 = "GET /" ascii wide nocase
        $s2 = "POST /" ascii wide nocase
        $s3 = "MQTT" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 256
}

Sigma Rule

title: CVE-2025-12056 Shelly Pro 3EM Out-of-Bounds Read Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects oversized HTTP requests targeting Shelly Pro 3EM devices
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        http.uri|length: > 256
        http.hostname|contains: "shelly"
    condition: selection
falsepositives:
    - Legitimate large firmware updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12056 Shelly Pro 3EM Out-of-Bounds Read Attempt"; flow:to_server; content:"GET"; http_method; content:"/"; http_uri; urilen:>256; reference:cve,2025-12056; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Firmware: Update all Shelly Pro 3EM devices to firmware version 1.4.4 or later. This is the only official patch.
2. Network Segmentation: Place the device on a separate VLAN with strict firewall rules to limit exposure.
3. Disable Unused Services: Turn off MQTT, HTTP, or other services if not required.

Long-Term Measures:

• Implement regular firmware update schedules.
• Monitor vendor advisories for future patches.
• Use network monitoring tools to detect anomalous traffic patterns.

Workarounds (if patching is not possible):

• Restrict access to the device via IP whitelisting.
• Use a reverse proxy to filter oversized requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert