CVE-2018-12716
- State
- Published
- Severity
- Not scored
- Published
- Jun 25, 2018
- Updated
- Sep 17, 2024
- Reserved
- Jun 24, 2018
Description
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its local network, extracting the scan_results bssid fields, and sending these fields in a geolocation/v1/geolocate Google Maps Geolocation API request.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/
- https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
- https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability/
- https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.