CVE-2024-44097

published 2024-10-02

CVE-2024-44097: According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server…

Priority P3 50 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server."

Affected

4 ranges

Vendor	Product	Version range	Fixed in
google	android	—	—
google	nest_cam_firmware	< 1.73c	1.73c
google	nest_cam_with_floodlight_firmware	< 1.73c	1.73c
google	nest_doorbell_firmware	< 1.73c	1.73c

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269