CVE-2020-24395 Code injection in n/a
An attacker with physical access can install compromised firmware on homee Brain Cube devices due to insufficient validation, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24395?
CVE-2020-24395 is a medium-severity code injection vulnerability in n/a, published on 20 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device.
Weakness: CWE-345
Which versions are affected by CVE-2020-24395?
It affects 1 product.
Products include Hom.ee Brain Cube Core.
How do I fix CVE-2020-24395?
No fix has been published for CVE-2020-24395 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-24395 being exploited?
There is no known exploitation of CVE-2020-24395 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mw35-grpm-83j9.