PT-2021-7057 · Anker · Anker Eufy Homebase 2

Lilith >_> · Published 2021-11-29 · Updated 2022-09-03 · CVE-2021-21955

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Anker Eufy Homebase 2 version 2.1.6.9h

Description An authentication bypass issue exists in the get aes key info by packetid() function of the home security binary. This is due to a limited number of possible random values. An attacker can exploit this by sniffing network traffic, potentially leading to password recovery. The vulnerability can be triggered remotely.

Recommendations For Anker Eufy Homebase 2 version 2.1.6.9h, consider disabling the get aes key info by packetid() function as a temporary workaround until a patch is available. Restrict access to the home security binary to minimize the risk of exploitation. Avoid using the affected system for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

CWE-334

Related Identifiers

BDU:2022-03115

CVE-2021-21955

Affected Products

Anker Eufy Homebase 2

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1382 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21955 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03115 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21955 · Security Note
• https://t.me/cibsecurity/33690 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021113006 · Note