Vulnerability record/PUBLISHED/Published Jul 31, 2024 05:51:03 UTC
CVE-2024-7205
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
Base score9.4/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredNonePR
User interactionPassiveUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityHighSA
Safety impactSafety impact presentS
AutomatableNoAU
RecoveryUserR
Value densityDiffuseV
Response effortLowRE
Provider urgencyGreenU
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:D/RE:L/U:GreenCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityCoolKit
Last updatedJul 31, 2024 14:56:35 UTC
PublishedJul 31, 2024 05:51:03 UTC
ReservedJul 29, 2024 11:11:17 UTC
Credits
- Aarav Sinha, Senior Security Researcher, FEV India Pvt Ltd.
- Jerin Sunny, Security Researcher, FEV India Pvt Ltd.
- Shakir Zari,Security Researcher,FEV India Pvt Ltd.