CVE-2023-4617
Gaining remote control over Govee devices
- State
- Published
- Severity
- 10.0 Critical
- Published
- Dec 19, 2024
- Updated
- Dec 20, 2024
- Reserved
- Aug 30, 2023
Description
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in versions before 5.9.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H | CERT-PL |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
Govee HomeGovee |
|
Govee HomeGovee |
|
References
- https://cert.pl/en/posts/2024/12/CVE-2023-4617/third-party-advisory
- https://cert.pl/posts/2024/12/CVE-2023-4617/third-party-advisory
- https://play.google.com/store/apps/details?id=com.govee.homeproduct
- https://apps.apple.com/us/app/govee-home/id1395696823product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.