Vendors / Shelly Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 2
Exploited now Shelly records in CISA KEV No Shelly vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 63
Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.04726 · Published 2023-08-02 · No fix listed CWE-125
Priority LOW 36
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM (before v1.6) allows Excessive Allocation via network.
CVSS 4.0 HIGH 8.3· Adjacent network · No auth · No interaction · EPSS 0.00426 · Published 2025-11-19 · Fixed in 1.6 CWE-770
Priority LOW 35
Out-of-bounds Read in Shelly Pro 3EM (before v1.4.4) allows Overread Buffers.
CVSS 4.0 HIGH 8.3· Adjacent network · No auth · No interaction · EPSS 0.00193 · Published 2025-11-19 · No fix listed CWE-125
Priority LOW 24
Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.
CVSS 3.1 MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00108 · Published 2024-01-23 · No fix listed CWE-319
Priority LOW 23
Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00155 · Published 2024-01-23 · No fix listed CWE-354
Open these records in search → All records by CVSS severity
0 2 3 0 0
THREATIST.IORead the docs