Govee Home vulnerabilities
2 vulnerabilities
Known vulnerabilities in Govee Home, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-4617goveegovee home
EPSS score0.61%
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values.
This issue affects Govee Home applications on Android and iOS in versions before 5.9.CVE-2023-3612goveegovee home+1EPSS score0.51%
Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.