CVE-2024-7206CWE-295CWE-798

Firmware extraction and Hardware SSL Pinning Bypass

High · published October 8, 2024

CVSS v4.0
7.0
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00237 · 13.9th percentile
Weaknesses
CWE-295 · Improper Certificate Validation; CWE-798 · Use of Hard-coded Credentials
Published
2024-10-08T06:14Z
EPSS history
Timeline
  • 08 OCT 06:14Z
    Firmware extraction and Hardware SSL Pinning Bypass
    cvelistv5