CVEvulnerability

CVE-2024-7205

9.4 CRITICAL Published 2024-07-31 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2024-07-31
Last modified
2026-06-17
Assigner
68870bb1-d075-4169-957d-e580b18692b9
CVSS 4.0 (68870bb1-d075-4169-957d-e580b18692b9)
9.4 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:D/RE:L/U:Green
Weaknesses
CWE-201

Description

When the device is shared, the homepage module are before 2.19.0  in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.

Related

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References