Marek Janiszewski

**Name of the Vulnerable Software and Affected Versions** Govee devices (affected versions not specified) Govee H6056 - lamp firmware version 1.08.13 **Description** A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account. The server-side API allows device association using identifiers: `device`, `sku`, `type`, and a client-computed `value`, which are not cryptographically bound to a secret originating from the device itself. This allows for trivial device takeover via identifier manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Govee Home versions prior to 5.9 **Description** The issue is related to an incorrect authorization vulnerability in the HTTP POST method in the Govee Home application on Android and iOS. This allows a remote attacker to control devices owned by other users via changing the `device`, `sku`, and `type` fields' values. **Recommendations** For versions prior to 5.9, update to version 5.9 to mitigate the risk. As a temporary workaround, consider restricting access to the HTTP POST method until the update is applied. Avoid using the `device`, `sku`, and `type` fields in the affected API endpoint until the issue is resolved.