PT-2024-13033 · Allterco · Shelly Trv

Adam Lindberg · Published 2024-01-23 · Updated 2024-01-31 · CVE-2023-42143

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Shelly TRV version 20220811-152343/v2.1.8@5afc928c

Description The issue allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device is then updated with the manipulated firmware.

Recommendations For Shelly TRV version 20220811-152343/v2.1.8@5afc928c, as a temporary workaround, consider restricting access to firmware updates until a patch is available. Avoid using unverified or unofficial firmware sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2023-42143

Affected Products

Shelly Trv

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-42143 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42143 · Vendor Advisory
• https://t.me/cvenotify/69360 · Telegram Post
• https://t.me/cvenotify/68512 · Telegram Post
• https://t.me/cvenotify/68413 · Telegram Post
• https://kth.se/cs/nse/research/software-systems-architecture-and-security/projects/ethical-hacking-1.1279219 · Note