PT-2023-29219

CVE-2023-44385

Publicado

2023-10-19

Atualizado

2023-10-26

Descrição por

CVSS 3.1

8.6

Alta

MétricasAV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant Companion for iOS and macOS versions up to 2023.4

Description The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can result in full compromise and remote code execution (RCE) when combined with other security advisories.

Recommendations For versions up to 2023.4, upgrade to version 2023.7 to address this issue. At the moment, there is no information about other workarounds for this vulnerability.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Pwntester

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-352: Cross-Site Request Forgery (CSRF)

Identificadores relacionados

CVE-2023-44385