CVE-2023-3612
High
Description
Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.
SeverityHigh
CVSS8.2
Exploit probability—
ProductGovee Home
PublishedSep 11, 2023
First seenSep 11, 2023
Weakness typeCWE-749CWE-749
How to fix
Update
- govee home5.8.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| govee home | v < 5.8.01 | 5.8.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.