Govee H6056 CVE-2025-10910

Exploitation targets Govee's cloud device-binding API and requires the victim's device to be online and cloud-connected, plus knowledge of its association identifiers (device, sku, type, and a client-computed value) which are not cryptographically bound to any device-held secret. The attacker needs a Govee account to receive the hijacked device (free self-registration), so this is closer to authenticated-attacker (PR:L) than truly unauthenticated despite the vendor's PR:N. Confirmed only for the Govee H6056 lamp at firmware 1.08.13; limiting factors: most H6056 units are already auto-patched server-side and via forced firmware updates, so realistic exposure is concentrated in unpatched units and specifically H6056 hardware versions 1.00.10/1.00.11 which cannot receive the fix.

This is a genuine high-priority flaw for affected devices, though several exploitation signals are absent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) rates it 9.3 (Critical): network-reachable, low complexity, no user interaction, full compromise of the device's confidentiality, integrity and availability. The core weakness is CWE-639 (authorization bypass via user-controlled key / IDOR) - the binding API trusts client-supplied identifiers (device, sku, type, value) that are not cryptographically tied to a secret from the device, so an attacker can claim someone else's online device. One disputable point: the vendor marks PR:N (unauthenticated), but the attack binds the device to 'the attacker's account,' which requires a (self-registered, free) Govee account - arguably PR:L. This does not meaningfully raise the barrier since Govee account creation is open, so the practical risk profile is unchanged. No EPSS score, no CISA KEV listing, and no public POC were provided; SSVC data is absent. So exploitation is technically easy but there is no evidence of active exploitation or a released exploit at this time. Net: real and easily exploitable weakness with high impact per device, but no current in-the-wild signal - priority is driven by the low technical barrier and mass-market device base, not by observed attacks. Mitigation is largely automatic (server-side fix plus auto firmware update), which materially lowers residual risk, except for H6056 hardware versions 1.00.10/1.00.11 which cannot be patched.

An attacker with a free Govee account learns or enumerates a target device's identifiers (device/sku/type/value) and submits a binding request to Govee's cloud API for a victim's online H6056 lamp. Because these identifiers are not cryptographically bound to a device secret, the server transfers ownership: the attacker gains full control of the device and it disappears from the legitimate owner's account. No user interaction is required and no public exploit code has been identified at time of analysis.