Loading story…
A critical vulnerability, tracked as CVE-2025-11243, has been identified in the Shelly Pro 4PM smart DIN rail switch, affecting versions prior to v1.6. The flaw is due to insufficient input bounds checking, allowing an attacker to send specially crafted requests to any RPC endpoint, which causes the device's JSON parser to overallocate memory. This results in the device rebooting and creates a denial-of-service (DoS) condition, potentially disrupting operations in environments where these devices are deployed. The vulnerability has been assigned a CVSS v4 score of 8.3, indicating high severity, and was reported by Gabriele Quagliarella of Nozomi Networks.
Shelly has not responded to coordination attempts from CISA, and users are advised to update their devices to versions later than 1.6.0 to mitigate the risk. The affected product is widely deployed in critical manufacturing sectors globally, and exploitation does not require remote access, as the vulnerability is not remotely exploitable. Organizations using Shelly Pro 4PM devices should ensure prompt patching and monitor for abnormal device reboots or service interruptions that could indicate exploitation attempts.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-11243, a high-severity denial-of-service flaw caused by uncontrolled resource allocation, was publicly disclosed for Shelly Pro 4PM devices running firmware before version 1.6. The disclosure credited Nozomi Networks and recommended upgrading to firmware 1.6 or later.
CISA published ICS advisory ICSA-25-322-02 covering a vulnerability affecting Shelly Pro 4PM devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified critical denial-of-service vulnerabilities in Shelly Pro smart devices used for home automation and industrial control. In the Shelly Pro 4PM, an attacker can send an oversized request through the device's remote-control interface, causing it to reboot and potentially locking users out of their smart homes or disabling connected circuits. This vulnerability affects 30 API methods and can be exploited repeatedly without special privileges, impacting the reliability of smart home and building systems. A separate but similar vulnerability was discovered in the Shelly Pro 3EM, where a specially crafted Modbus request can trigger an out-of-bounds read, forcing the device to reboot and resulting in a denial-of-service condition. Both vulnerabilities were reported by Nozomi Networks, and the Pro 3EM issue has been assigned CVE-2025-12056 with a CVSS v4 score of 8.3. Shelly has not responded to coordination attempts, and users are advised to minimize network exposure and implement defensive measures to reduce the risk of exploitation.
Jun 29, 2026
A high-severity vulnerability, tracked as CVE-2025-9368, has been identified in the 432ES-IG3 Series A GuardLink® EtherNet/IP Interface. This flaw allows remote attackers to trigger a denial-of-service condition, requiring a manual power cycle to restore device functionality. The issue was discovered during internal testing and has been acknowledged by Rockwell Automation, which has released a security advisory confirming the vulnerability and its impact. No known exploitation in the wild has been reported, and the vulnerability has been corrected according to the vendor. There are currently no workarounds available, and affected product versions have not been explicitly listed. Organizations using the 432ES-IG3 Series A are advised to review the official Rockwell Automation advisory and apply any recommended mitigations or updates to reduce risk of service disruption.
Jun 29, 2026
CISA and Schneider Electric disclosed a critical vulnerability in the EcoStruxure OPC UA Server Expert and Modicon Communication Server products, which are widely deployed in commercial facilities, critical manufacturing, and energy sectors. The flaw, tracked as CVE-2024-10085, is an 'allocation of resources without limits or throttling' issue that allows remote attackers to cause a denial of service by sending a large number of OPC UA requests, potentially resulting in the loss of real-time process data from Modicon Controllers. The vulnerability has a CVSS v3.1 base score of 7.5 and a CVSS v4 base score of 8.2, indicating a high level of risk, and was reported by Jin Huang of ADLab of Venustech. Schneider Electric has released a fix for the EcoStruxure OPC UA Server Expert in version SV2.01 SP3, which is available for download. For users unable to immediately apply the update, Schneider Electric recommends implementing specific mitigations to reduce the risk of exploitation. A permanent remediation plan is also being developed for all future versions of the Modicon Communication Server. CISA urges asset owners and operators in affected sectors to review the advisories and apply the recommended mitigations to protect against potential denial-of-service attacks targeting these critical industrial control systems.
Jun 29, 2026