Skip to main content

CISA issues alert for Shelly Pro 3EM vulnerability causing denial of service

Source Decision Insights Threat Desk Published November 25, 2025 Companies 1
Human View Machine View

309th article in the last 90 days, one of 416 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on Schneider Electric PowerChute Serial Shutdown vulnerabilities (Nov 2025).

Companies mentioned

Best suited for

Decision stage
Post Buy
Adoption curve
Early Majority
Industry
Industrials / Capital Goods / Electrical Equipment

Our classification, not the publisher's statement. Best suited for, not only for.

The Shelly Pro 3EM smart DIN rail switch contains a vulnerability involving an out-of-bounds read that can lead to the device rebooting, potentially resulting in a Denial of Service (DoS) condition.

This issue, identified as CVE-2025-12056, affects all versions of the Pro 3EM device. It arises when the device processes a specially crafted Modbus request that directs it to access an unauthorized data address without proper error handling. This vulnerability carries a Common Vulnerability Scoring System (CVSS) version 3 base score of 7.4 and a CVSS version 4 base score of 8.3. The vectors correspond to attacks requiring low complexity and no privileges or user interaction, with impacts on availability but not confidentiality or integrity.

The consequence of exploiting this vulnerability is a DoS state caused by device rebooting following the invalid data access.

Shelly, the vendor headquartered in Bulgaria, Decentralized Identity (DID) not respond to coordination attempts by the Cybersecurity and Infrastructure Security Agency (CISA). Users are advised to contact Shelly for updates. CISA recommends minimizing network exposure for these devices, placing control systems behind firewalls, isolating them from business networks, and using secure remote access methods such as virtual private networks while keeping these updated.

Organizations are encouraged to conduct impact analyses and risk assessments before applying defensive measures. Resources with recommended practices for control system security and cyber defense strategies are available on CISA's industrial control systems webpage. Entities detecting suspected malicious activity should follow internal protocols and report incidents to CISA. At this time, there is no indication of public exploitation targeting this vulnerability, which is not exploitable remotely.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-for-shelly-pro-3em-vulnerability-causing-denial-of-service/",
        "name": "CISA issues alert for Shelly Pro 3EM vulnerability causing denial of service",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-for-shelly-pro-3em-vulnerability-causing-denial-of-service/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "Shelly and Sands"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Industrials / Capital Goods / Electrical Equipment"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:09:51-06:00",
    "datePublished": "2025-11-25T13:18:26-07:00",
    "description": "Shelly Pro 3EM switch has a CVE-2025-12056 vulnerability causing denial of service via out-of-bounds read on Modbus requests.",
    "headline": "CISA issues alert for Shelly Pro 3EM vulnerability causing denial of service",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-03"
    },
    "keywords": [
      "Common Vulnerability Scoring System",
      "Denial of Service",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-for-shelly-pro-3em-vulnerability-causing-denial-of-service/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages