PT-2023-29219

CVE-2023-44385

Published

2023-10-19

Updated

2023-10-26

Description by

CVSS 3.1

8.6

High

MetricsAV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant Companion for iOS and macOS versions up to 2023.4

Description The issue allows attackers to send malicious links or QRs to victims, which can lead to calling arbitrary services in their Home Assistant installation. This can result in full compromise and remote code execution (RCE) when combined with other security advisories.

Recommendations For versions up to 2023.4, upgrade to version 2023.7 to address this issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploitability

Exploit

Fix

Impacts

Researchers

Pwntester

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers

CVE-2023-44385