Paper/Archive/CVE-2023-4617

CVE-2023-4617

Govee Govee Home — Gaining remote control over Govee devices

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 49.1.491 × 209.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in versions before 5.9.

Affected

ProductAffectedFixed inSource

Govee Home< 5.95.9CNA

Scores by source

CERT-PL (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupcert.pl/en/posts/2024/12/CVE-2023-4617 writeupcert.pl/posts/2024/12/CVE-2023-4617 refplay.google.com/store/apps/details?id=com.govee.home refapps.apple.com/us/app/govee-home/id1395696823