PT-2023-29219 · Home Assistant · Home Assistant Companion

Pwntester · Published 2023-10-19 · Updated 2023-10-26 · CVE-2023-44385

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant Companion for iOS and macOS versions up to 2023.4

Description The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can result in full compromise and remote code execution (RCE) when combined with other security advisories.

Recommendations For versions up to 2023.4, upgrade to version 2023.7 to address this issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-44385

GHSA-H2JP-7GRC-9XPP

Affected Products

Home Assistant Companion

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44385.json · Exploit
• https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44385 · Security Note
• https://t.me/cvenotify/59766 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1715164212400419122 · Twitter Post
• https://twitter.com/CVEnew/status/1715133138177839482 · Twitter Post