Govee
Monthly
Device hijacking in Govee's cloud-connected ecosystem, verified on the H6056 lamp running firmware 1.08.13, allows a remote attacker to bind an existing, online Govee device to their own account, gaining full control of the device and removing it from the legitimate owner's account. The attack works against the server-side device-binding API, which accepts a set of association identifiers ('device', 'sku', 'type', and a client-computed 'value') that are not cryptographically bound to a secret held by the device itself, so knowing those values is sufficient to claim the device. Govee has deployed server-side hardening plus automatic firmware updates that have already patched most H6056 units, but hardware versions 1.00.10 and 1.00.11 cannot be updated at all; other Govee cloud-connected models may also be affected and are still under vendor investigation. No public exploit code and no confirmed active exploitation have been identified at time of analysis. Note that our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, treating the attacker as requiring a Govee account (free self-registration) rather than the vendor's unauthenticated PR:N posture.
An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Govee Home app has unprotected access to WebView component which can be opened by any app on the device. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Device hijacking in Govee's cloud-connected ecosystem, verified on the H6056 lamp running firmware 1.08.13, allows a remote attacker to bind an existing, online Govee device to their own account, gaining full control of the device and removing it from the legitimate owner's account. The attack works against the server-side device-binding API, which accepts a set of association identifiers ('device', 'sku', 'type', and a client-computed 'value') that are not cryptographically bound to a secret held by the device itself, so knowing those values is sufficient to claim the device. Govee has deployed server-side hardening plus automatic firmware updates that have already patched most H6056 units, but hardware versions 1.00.10 and 1.00.11 cannot be updated at all; other Govee cloud-connected models may also be affected and are still under vendor investigation. No public exploit code and no confirmed active exploitation have been identified at time of analysis. Note that our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, treating the attacker as requiring a Govee account (free self-registration) rather than the vendor's unauthenticated PR:N posture.
An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Govee Home app has unprotected access to WebView component which can be opened by any app on the device. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.