Lucene search

MitreCVE-2023-33383

HistoryAug 02, 2023 - 2:15 p.m.

CVE-2023-33383

2023-08-0214:15:10

CWE-125

mitre

web.nvd.nist.gov

shelly 4pm pro

smart switch

cve-2023-33383

ble

out of bounds read

fault

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.1

Confidence

High

EPSS

0.041

Percentile

92.3%

JSON

Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a device reload.

Affected configurations

Nvd

Node

shellypro_4pmMatch-

AND

shellypro_4pm_firmwareMatch0.11.0

VendorProductVersionCPE
shellypro_4pm-cpe:2.3:h:shelly:pro_4pm:-:*:*:*:*:*:*:*
shellypro_4pm_firmware0.11.0cpe:2.3:o:shelly:pro_4pm_firmware:0.11.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
shelly	pro_4pm	-	cpe:2.3:h:shelly:pro_4pm:-:::::::*
shelly	pro_4pm_firmware	0.11.0	cpe:2.3:o:shelly:pro_4pm_firmware:0.11.0:::::::*

References

packetstormsecurity.com/files/173954/Shelly-PRO-4PM-0.11.0-Authentication-Bypass.html

www.exploitsecurity.io/post/cve-2023-33383-authentication-bypass-via-an-out-of-bounds-read-vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.1

Confidence

High

EPSS

0.041

Percentile

92.3%

JSON

Related for CVE-2023-33383