PT-2025-47440 · Shelly · Shelly 4Pm Pro

Published 2025-11-19 · Updated 2025-11-21 · CVE-2025-11243

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Shelly Pro 4PM versions prior to 1.6

Description A flaw exists in Shelly Pro 4PM that allows for excessive resource allocation through the network. This can lead to a denial of service due to resource exhaustion. Unauthenticated attackers can exploit this issue.

Recommendations Update to firmware version 1.6 or later. Restrict network access to the device.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-11243

Affected Products

Shelly 4Pm Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-11243 · Security Note
• https://t.me/cveNotify/143308 · Telegram Post
• https://nozominetworks.com/blog/shelly-pro-4pm-vulnerabilities · Note
• https://t.me/CVEtracker/37722 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-322-02 · Note
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-11243 · Note
• https://twitter.com/CVEnew/status/1991042902911283470 · Twitter Post
• https://t.me/cveNotify/143629 · Telegram Post
• https://twitter.com/offseq/status/1991046781820436765 · Twitter Post