Shelly’s Shellshock: Pro 4PM Vulnerability Sparks Denial-of-Service Drama!
An unpatched Shelly Pro 4PM could have you seeing red with a denial-of-service condition! Due to unchecked input bounds, your smart switch might just outsmart itself by rebooting. While Shelly’s ghosting CISA, users should update past version 1.6 to avoid the technical equivalent of a toddler’s tantrum. View CSAF for more details.
Hot Take:
In the realm of cybersecurity, the Shelly Pro 4PM is the equivalent of a party crasher who eats all the snacks and leaves without saying goodbye. With its vulnerability to allocation of resources without limits, it’s the smart switch that’s not quite smart enough to keep hackers at bay. Be prepared, because this could lead to an unwanted blackout party for your devices!
Key Points:
- CVSS v4 score of 8.3 signals serious vulnerability.
- Low attack complexity makes it easy for attackers.
- Pro 4PM devices prior to v1.6 are affected.
- Attack causes denial-of-service by memory overallocation.
- Mitigations include network isolation and VPN use.
Already a member? Log in here