CVE-2021-21955
published 2021-12-09CVE-2021-21955: An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.98%
57.7th percentile
An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anker | eufy_homebase_2_firmware | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.07.7HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
blogs_talos·2021-10-12·CVSS 10.0
[CRITICAL] Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
UUpdate (Nov. 29, 2021): Anker patched five other vulnerabilities in this product affecting the same version as originally listed in this blog. These have been added to the post.
Lilith >_> of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered two vulnerabilities in the Anker Eufy Homebase.
The Eufy Homebase 2 is the video storage and networking gateway that works with Anker’s Eufy Smarthome ecosystem. All Eufy devices connect to this cloud-connected device and allow users to adjust the settings on other Eufy Smarthome devices. TALOS-2021-1369 (CVE-2021-21940) is a heap-based buffer overflow vulnerability in Homebase’s pushMuxer processRtspInfo functionality. An attacker could send a malicious packet to trigger this vulnerability, causing a heap-based buffer over
Talos
Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
blogs_talos·2021-10-12·CVSS 10.0
[CRITICAL] Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
## Vulnerability Spotlight: Vulnerabilities in Anker Eufy Homebase could lead to code execution, buffer overflows
UUpdate (Nov. 29, 2021): Anker patched five other vulnerabilities in this product affecting the same version as originally listed in this blog. These have been added to the post.
Lilith >_> of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered two vulnerabilities in the Anker Eufy Homebase.
The Eufy Homebase 2 is the video storage and networking gateway that works with Anker’s Eufy Smarthome ecosystem. All Eufy devices connect to this cloud-connected device and allow users to adjust the settings on other Eufy Smarthome devices. TALOS-2021-1369 (CVE-2021-21940) is a heap-based buffer overflow vulnerability in Homebase’s pushMuxer processRtspInfo funct
2021-12-09
Published