CVE-2023-37822

Katalog CVE

CVSS 8.2 · High EPSS 0,23%

Kerentanan Insufficient Entropy pada eufy homebase 2 firmware. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation process, the WPA2-PSK can be brute forced offline within seconds. This vulnerability allows an attacker in proximity to the dedicated wireless network to gain unauthorized access to the end user's primary network. The only requirement of the attack is proximity to the dedicated wireless network.

Rincian

Terbit di NVD

3 Oktober 2024

Terakhir diubah

5 Juli 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-331: Insufficient Entropy

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.usenix.org/conference/woot24/presentation/goeman deskripsi teknis
• https://www.usenix.org/system/files/woot24-goeman.pdf deskripsi teknis