CVE-2020-36517 Information disclosure in n/a
A hardcoded DNS resolver configuration in Home Assistant OS allows attackers to leak internal network resource information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36517?
CVE-2020-36517 is a high-severity vulnerability in n/a, published on 7 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.
Weakness: CWE-203
Which versions are affected by CVE-2020-36517?
It affects 1 product.
Products include Home-Assistant Home-Assistant.
How do I fix CVE-2020-36517?
No fix has been published for CVE-2020-36517 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36517 being exploited?
There is no known exploitation of CVE-2020-36517 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-27482 Auth bypass in core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2018-21019 Home Assistant information disclosure vulnerability
Sources
Also known as GHSA-wj7x-544h-j3j3.