CVE-2024-7205CWE-201

sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user

Critical · published July 31, 2024

CVSS v4.0
9.4
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

When the device is shared, the homepage module are before 2.19.0  in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:D/RE:L/U:Green
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2024-07-31T05:51Z
EPSS history
Timeline
  • 31 JUL 05:51Z
    sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user
    cvelistv5