PT-2024-38166 · Unknown · Ewelink Cloud Service

Published 2024-07-31 · Updated 2025-09-02 · CVE-2024-7205

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions eWeLink Cloud Service versions prior to 2.19.0

Description The issue allows a secondary user to take over devices as the primary user via sharing unnecessary device-sensitive information when the device is shared. This is due to a problem in the homepage module of the eWeLink Cloud Service.

Recommendations For versions prior to 2.19.0, update the eWeLink Cloud Service to version 2.19.0 or later to resolve the issue. As a temporary workaround, consider restricting device sharing to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2024-7205

Affected Products

Ewelink Cloud Service

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-7205 · Security Note
• https://reddit.com/r/CVEWatch/comments/1n6fh7b/top_10_trending_cves_02092025 · Reddit Post
• https://twitter.com/Komodosec/status/1832072040075120722 · Twitter Post
• https://ewelink.cc/security-advisory-240730 · Note
• https://t.me/pentestingnews/49765 · Telegram Post
• https://twitter.com/ShakirZari/status/1955590085895672090 · Twitter Post
• https://t.me/cvenotify/88011 · Telegram Post
• https://t.me/cvedetector/2107 · Telegram Post
• https://t.me/cvenotify/88078 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1n5kq6z/top_10_trending_cves_01092025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1n4qxv2/top_10_trending_cves_31082025 · Reddit Post
• https://twitter.com/0xor0ne/status/1961813701796696385 · Twitter Post
• https://twitter.com/oktsec/status/1822969834218356885 · Twitter Post