Shelly records
4 published records for vendor shelly.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-125 Out-of-bounds Read1
- CWE-306 Missing Authentication for Critical Function1
- CWE-319 Cleartext Transmission of Sensitive Information1
- CWE-354 Improper Validation of Integrity Check Value1
The weakness classes this vendor ships most often: where to look.
CWEAll records
4 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
30Monitor | CVE-2024-48776No exploit | An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update processCWE-306 | High7.5 | — | 0.4% | Oct 11, 2024 |
22Monitor | CVE-2023-33383Proof of concept | Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a devshelly · pro 4pm firmware · CWE-125 | Medium5.3 | — | 4.7% | Aug 2, 2023 |
22Monitor | CVE-2023-42144No exploit | Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.shelly · trv firmware · CWE-319 | Medium5.5 | — | 0.1% | Jan 23, 2024 |
21Monitor | CVE-2023-42143No exploit | Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device shelly · trv firmware · CWE-354 | Medium5.4 | — | 0.1% | Jan 23, 2024 |
- CVE-2024-4877630Monitor
An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process
HighCVSS 7.5No exploitEPSS 0%Oct 11, 2024
- CVE-2023-3338322Monitor
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a dev
MediumCVSS 5.3Proof of conceptEPSS 4%shelly · pro 4pm firmwareAug 2, 2023
- CVE-2023-4214422Monitor
Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.
MediumCVSS 5.5No exploitEPSS 0%shelly · trv firmwareJan 23, 2024
- CVE-2023-4214321Monitor
Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device
MediumCVSS 5.4No exploitEPSS 0%shelly · trv firmwareJan 23, 2024