CVE-2025-10910

{"id": "CVE-2025-10910", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10910", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T14:40:37.275880Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "Govee", "modules": ["firmware"], "product": "H6056", "versions": [{"status": "affected", "version": "1.08.13", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-12-18T12:16:07.963", "references": [{"url": "https://cert.pl/en/posts/2025/12/CVE-2025-10910/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "A flaw in the binding process of Govee\u2019s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker\u2019s account, resulting in full control of the device and removal of the device from its legitimate owner\u2019s account.\nThe server\u2011side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client\u2011computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud\u2011connected devices.\u00a0The vendor is investigating other potentially affected models.\n\nThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\n \nGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations."}, {"lang": "es", "value": "Una falla en el proceso de vinculaci\u00f3n de la plataforma en la nube y los dispositivos de Govee permite a un atacante remoto vincular un dispositivo Govee existente y en l\u00ednea a la cuenta del atacante, lo que resulta en el control total del dispositivo y la eliminaci\u00f3n del dispositivo de la cuenta de su propietario leg\u00edtimo.\nLa API del lado del servidor permite la asociaci\u00f3n de dispositivos utilizando un conjunto de identificadores: 'device', 'sku', 'type', y un 'value' calculado por el cliente, que no est\u00e1n vinculados criptogr\u00e1ficamente a un secreto originado desde el propio dispositivo.\n\nLa vulnerabilidad ha sido verificada para el dispositivo Govee H6056 - l\u00e1mpara en la versi\u00f3n de firmware 1.08.13, pero tambi\u00e9n puede afectar a otros dispositivos Govee conectados a la nube. El proveedor est\u00e1 investigando otros modelos potencialmente afectados.\n\nEl proveedor ha implementado mejoras de seguridad del lado del servidor y actualizaciones autom\u00e1ticas de firmware para el modelo H6056. La mayor\u00eda de los dispositivos H6056 han sido parcheados exitosamente a trav\u00e9s de actualizaciones autom\u00e1ticas. Los usuarios restantes de H6056 con versiones de hardware actualizables deben actualizar manualmente el firmware a trav\u00e9s de la aplicaci\u00f3n Govee Home mientras mantienen su dispositivo conectado a WiFi. Los usuarios deben abrir la aplicaci\u00f3n Govee Home, tocar la tarjeta de su dispositivo H6056 para ingresar a la p\u00e1gina de detalles del dispositivo, tocar el icono de configuraci\u00f3n en la esquina superior derecha, navegar a la secci\u00f3n Informaci\u00f3n del Dispositivo (Versi\u00f3n de Firmware), y tocar el bot\u00f3n Actualizar para instalar el parche de seguridad inmediatamente.\n\nLos dispositivos Govee H6056 con versiones de hardware 1.00.10 o 1.00.11 no pueden recibir la actualizaci\u00f3n de firmware debido a limitaciones de hardware."}], "lastModified": "2026-09-30T23:10:00.237", "sourceIdentifier": "cvd@cert.pl"}