PT-2024-38167 · Ewelink · Ewelink

Published 2024-10-07 · Updated 2025-08-31 · CVE-2024-7206

Positive Technologies · (AI Summary)

CVSS v4.0

7.0

7.0

High

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions:

eWeLink (affected versions not specified)

Description:

A local attacker can decrypt TLS communication and extract secrets to clone the device via flashing modified firmware due to a missing SSL pinning implementation.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Using Hardcoded Credentials

Weakness Enumeration

CWE-295

CWE-798

Related Identifiers

CVE-2024-7206

Affected Products

Ewelink

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-7206 · Security Note
• https://ewelink.cc/security-advisory-firmware-extraction-and-hardware-ssl-pinning-bypass · Note
• https://twitter.com/CVEnew/status/1843543409018958221 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1n4qxv2/top_10_trending_cves_31082025 · Reddit Post
• https://t.me/cvedetector/7318 · Telegram Post
• https://twitter.com/ShakirZari/status/1955590085895672090 · Twitter Post
• https://twitter.com/0xor0ne/status/1961813701796696385 · Twitter Post