CVE-2024-44097
Critical
Description
According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server."
SeverityCritical
CVSS9.8
Exploit probability—
Product
Google Nest Doorbell \(battery\) Firmware
PublishedOct 2, 2024
First seenOct 2, 2024
Weakness typeCWE-269Improper privilege management
How to fix
Update
- google nest_doorbell_\(battery\)_firmware1.73c or later
- google nest_cam_\(outdoor_or_indoor\,_battery\)_firmware1.73c or later
- google nest_cam_with_floodlight_firmware1.73c or later
- google nest_cam_\(indoor\,_wired\)_firmware1.73c or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google nest_doorbell_\(battery\)_firmware | v < 1.73c | 1.73c |
| google nest_cam_\(outdoor_or_indoor\,_battery\)_firmware | v < 1.73c | 1.73c |
| google nest_cam_with_floodlight_firmware | v < 1.73c | 1.73c |
| google nest_cam_\(indoor\,_wired\)_firmware | v < 1.73c | 1.73c |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.