PT-2025-52214 · Govee · Govee Devices+1

Jan Adamski + 1 · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-10910

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Govee devices (affected versions not specified) Govee H6056 - lamp firmware version 1.08.13

Description A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account. The server-side API allows device association using identifiers: device, sku, type, and a client-computed value, which are not cryptographically bound to a secret originating from the device itself. This allows for trivial device takeover via identifier manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-10910

Affected Products

Govee H6056

Govee Devices

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10910 · Security Note
• https://t.me/CVEtracker/40143 · Telegram Post
• https://cert.pl/en/posts/2025/12/CVE-2025-10910 · Note
• https://twitter.com/CVEnew/status/2001728081405620445 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001646864962097427 · Twitter Post
• https://twitter.com/0dayPublishing/status/2001618626508431699 · Twitter Post