CVE-2023-44385

· HIGHModified

← All CVEs

CVSS v3.1

8.6

EPSS

0.28%

Published

Oct 19, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-352CWE-352

Affected Products (2)

home-assistant · home_assistant_companion (up to 2023.7)vulnerable

References (2)

https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp

Vendor Advisory

https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs