Skip to main content

CISA issues alert on Shelly Pro 4PM vulnerability causing denial of service

Source Decision Insights Threat Desk Published November 25, 2025 Companies 1
Human View Machine View

310th article in the last 90 days, one of 417 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert for Shelly Pro 3EM vulnerability causing denial of service (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Industrials / Capital Goods / Electrical Equipment / Electrical

Our classification, not the publisher's statement. Best suited for, not only for.

The Shelly Pro 4PM smart DIN rail switch models with firmware versions before 1.6 contain a vulnerability related to unrestricted allocation of resources, which can lead to Denial of Service (DoS) conditions upon exploitation.

The vulnerability, identified as CVE-2025-11243, affects the device's JSON parser within its RPC. An attacker who sends a carefully crafted request to any RPC endpoint can trigger excessive memory allocation, prompting the device to reboot and causing a DoS state. Shelly Pro 4PM devices running firmware versions prior to 1.6 are impacted by this issue. The vulnerability has been assigned a Common Vulnerability Scoring System (CVSS) version 3 base score of 7.4 with the vector (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) and a CVSS version 4 base score of 8.3 with vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H).

Exploitation can result in service interruption due to device rebooting caused by the JSON parser's excessive memory allocation, leading to DoS.

There is no response from the vendor to coordination attempts. Users are advised to upgrade their Shelly Pro 4PM devices to firmware version 1.6 or later, as these versions do not exhibit the vulnerability.

Recommendations include limiting network exposure of affected systems by preventing direct internet access, isolating control system networks behind firewalls, and utilizing secure remote access mechanisms such as virtual private networks (VPNs) while maintaining updated software versions. Organizations should conduct thorough impact and risk assessments before applying any defensive controls. Further guidance is available through established control systems security practices and technical information papers provided by cybersecurity authorities. Suspected malicious activities should be handled according to internal procedures and reported for incident correlation. To date, no public exploitation or remote exploitability of this vulnerability has been reported.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-shelly-pro-4pm-vulnerability-causing-denial-of-service/",
        "name": "CISA issues alert on Shelly Pro 4PM vulnerability causing denial of service",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-shelly-pro-4pm-vulnerability-causing-denial-of-service/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "Shelly and Sands"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Industrials / Capital Goods / Electrical Equipment / Electrical"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:18:21-06:00",
    "datePublished": "2025-11-25T13:18:39-07:00",
    "description": "Shelly Pro 4PM devices before version 1.6 have a resource allocation vulnerability causing denial of service; updating firmware mitigates the issue.",
    "headline": "CISA issues alert on Shelly Pro 4PM vulnerability causing denial of service",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-02"
    },
    "keywords": [
      "Common Vulnerability Scoring System",
      "Denial of Service",
      "Firmware",
      "JSON",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-shelly-pro-4pm-vulnerability-causing-denial-of-service/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages