CVEvulnerability

CVE-2024-7206

7.0 HIGH Published 2024-10-08 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2024-10-08
Last modified
2026-06-17
Assigner
68870bb1-d075-4169-957d-e580b18692b9
CVSS 4.0 (68870bb1-d075-4169-957d-e580b18692b9)
7.0 HIGH — CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-295, CWE-798

Description

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

Related

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References