CVE-2021-21953
published 2021-12-22CVE-2021-21953: An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted…
PriorityP343high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.98%
57.7th percentile
An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anker | eufy_homebase_2_firmware | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.7HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
blogs_talos·2021-10-12·CVSS 10.0
[CRITICAL] Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
UUpdate (Nov. 29, 2021): Anker patched five other vulnerabilities in this product affecting the same version as originally listed in this blog. These have been added to the post.
Lilith >_> of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered two vulnerabilities in the Anker Eufy Homebase.
The Eufy Homebase 2 is the video storage and networking gateway that works with Anker’s Eufy Smarthome ecosystem. All Eufy devices connect to this cloud-connected device and allow users to adjust the settings on other Eufy Smarthome devices. TALOS-2021-1369 (CVE-2021-21940) is a heap-based buffer overflow vulnerability in Homebase’s pushMuxer processRtspInfo functionality. An attacker could send a malicious packet to trigger this vulnerability, causing a heap-based buffer over
Talos
Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
blogs_talos·2021-10-12·CVSS 10.0
[CRITICAL] Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
## Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
UUpdate (Nov. 29, 2021): Anker patched five other vulnerabilities in this product affecting the same version as originally listed in this blog. These have been added to the post.
Lilith >_> of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered two vulnerabilities in the Anker Eufy Homebase.
The Eufy Homebase 2 is the video storage and networking gateway that works with Anker’s Eufy Smarthome ecosystem. All Eufy devices connect to this cloud-connected device and allow users to adjust the settings on other Eufy Smarthome devices. TALOS-2021-1369 (CVE-2021-21940) is a heap-based buffer overflow vulnerability in Homebase’s pushMuxer processRtspInfo funct
2021-12-22
Published