CVE-2021-21950 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Eufy Homebase 2 Firmware

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-1284 — Improper Validation of Specified Quantity in InputCWE-787 — Out-of-bounds Write4 documents3 sources
Severity
10.0CRITICALNVD
EPSS
0.9%
top 24.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Anker Eufy Homebase 2 Firmware
Timeline
PublishedDec 8
Latest updateDec 9

Description

An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h in function recv_server_device_response_msg_process. A specially-crafted network packet can lead to code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-mh9p-pq79-6q5x: An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase↗2021-12-09
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows↗2021-10-12
▶
Talos
Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows↗2021-10-12
▶