PT-2023-29219 · Home Assistant · Home Assistant Companion

Pwntester · Publicado 2023-10-19 · Atualizado 2023-10-26 · CVE-2023-44385

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant Companion for iOS and macOS versions up to 2023.4

Description The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can result in full compromise and remote code execution (RCE) when combined with other security advisories.

Recommendations For versions up to 2023.4, upgrade to version 2023.7 to address this issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-44385

GHSA-H2JP-7GRC-9XPP

Produtos afetados

Home Assistant Companion

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44385.json · Exploit
• https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-44385 · Aviso do Fabricante
• https://t.me/cvenotify/59766 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-44385 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1715164212400419122 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1715133138177839482 · Publicação no Twitter