« Volver al listado

CVE-2023-3612

Estado: ModificadaAlta (8.8)—

Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Govee — Home

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-3612",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3612",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-26T14:32:16.829725Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "incident@nbu.gov.sk",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "incident@nbu.gov.sk",
      "affectedData": [
        {
          "vendor": "Govee",
          "product": "Govee Home",
          "versions": [
            {
              "status": "affected",
              "version": "5.7.03",
              "lessThan": "5.8.01",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Android",
            "iOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-09-11T10:15:07.603",
  "references": [
    {
      "url": "https://www.sk-cert.sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "incident@nbu.gov.sk"
    },
    {
      "url": "https://www.sk-cert.sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "incident@nbu.gov.sk",
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content. "
    },
    {
      "lang": "es",
      "value": "La aplicación Govee Home tiene acceso desprotegido al componente WebView que puede abrir cualquier aplicación en el dispositivo. Al enviar una URL a un sitio manipulado, el atacante puede ejecutar JavaScript en el contexto de WebView o robar datos confidenciales del usuario mostrando contenido de phishing."
    }
  ],
  "lastModified": "2026-06-17T06:14:27.973",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:govee:home:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A620D3FC-BFD8-4142-B655-C1115D8871FF",
              "versionEndExcluding": "5.8.01"
            },
            {
              "criteria": "cpe:2.3:a:govee:home:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C81C8BA3-1AE7-4FC3-B52A-273210034903",
              "versionEndExcluding": "5.8.01"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "incident@nbu.gov.sk"
}