CVE-2022-26073 Integer overflow in Eufy Homebase 2

High 7.4 Published 5 May 2022 Updated 15 Apr 2025

An attacker can cause a device reboot by sending specially crafted network packets to the Anker Eufy Homebase 2.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-26073?

CVE-2022-26073 is a high-severity vulnerability in Anker Eufy Homebase 2, published on 5 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to a device reboot. An attacker can send packets to trigger this vulnerability.

Weakness: CWE-190

Which versions are affected by CVE-2022-26073?

It affects 1 product.

Products include Anker Eufy Homebase 2 Firmware.

How do I fix CVE-2022-26073?

No fix has been published for CVE-2022-26073 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-26073 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-26073 exists.

Sources

Also known as GHSA-7j97-rqv4-wfhw.