Paper/Archive/CVE-2024-7205

CVE-2024-7205

CoolKit eWeLink Cloud Service — sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user

EPSS 0.5%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 42.7.427 × 208.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.

Affected

ProductAffectedFixed inSource

eWeLink Cloud Service2.0.0 – < 2.19.02.19.0CNA

ewelink< 2.19.02.19.0CISA-ADP

Scores by source

CoolKit (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:D/RE:L/U:Green

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refewelink.cc/security-advisory-240730