CVE-2023-4617criticalCWE-863

CVE-2023-4617: critical vulnerability in Govee Home

Gaining remote control over Govee devices

Published · Updated

Follow this CVE+ Monitor Govee Home

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 0.6%
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values.  This issue affects Govee Home applications on Android and iOS in versions before 5.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
Affected products
Govee · Govee Home
Related CVEs — Govee Home

In the same product, most dangerous first.

CVE-2023-3612HIGHUnprotected WebView access in Govee Home AppEPSS 0.5%