CVE-2022-25989 Auth bypass in Eufy Homebase 2

High 7.1 Published 5 May 2022 Updated 15 Apr 2025

An attacker can bypass authentication on Anker Eufy Homebase 2 by sending a specially crafted DHCP packet, potentially gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-25989?

CVE-2022-25989 is a high-severity authentication bypass vulnerability in Anker Eufy Homebase 2, published on 5 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted DHCP packet can lead to authentication bypass. An attacker can DHCP poison to trigger this vulnerability.

Weakness: CWE-290

Which versions are affected by CVE-2022-25989?

It affects 1 product.

Products include Anker Eufy Homebase 2 Firmware.

How do I fix CVE-2022-25989?

No fix has been published for CVE-2022-25989 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-25989 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25989 exists.

Sources

Also known as GHSA-3wpv-xcvc-6543.