CVE-2023-4617 — Gaining remote control over Govee devices
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changin…
Published: 2024-12-19 · CVSS: 10.0 · CVSS 3.1
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in versions before 5.9.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7