EUVD-2025-204256
ID: EUVD-2025-204256
Severity: critical
CVSS v4: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVSS v3: Not provided
CWE: None listed
Source: ENISA
Description
A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account. The server‑side API allows device association using a set of identifiers: "device", "sku", "type", and a client‑computed "value", that are not cryptographically bound to a secret originating from the device itself. The vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is investigating other potentially affected models. Govee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware updates due to hardware limitations.
Timestamps
- Normalized:
- Last updated:
References
No references provided.