{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-10910 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2025-10910 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-10910 is a critical authentication bypass vulnerability in Govee H6056, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-10910 and fix it if it is affected.\n\nWhat it is: CVE-2025-10910 is a critical authentication bypass vulnerability in Govee H6056, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-10910 in the wild and no public exploit code.\n\nAffected product: Govee H6056. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-10910/ (Markdown: https://insights.sbomify.com/CVE-2025-10910/index.md)","id":"CVE-2025-10910","markdown":"https://insights.sbomify.com/CVE-2025-10910/index.md","name":"CVE-2025-10910","record":{"aliases":["GHSA-7fj8-g5x7-m9v3"],"analysis":{"component_type":"iot_embedded","fix_type":"patch","impacts":["account_takeover","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Govee smart lamp","requires_auth":"none","summary":"Remote attackers can hijack Govee smart devices by exploiting weak device binding, gaining full control and removing legitimate owners.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"CERT-PL","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"description":"A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account.\nThe server‑side API allows device association using a set of identifiers: \"device\", \"sku\", \"type\", and a client‑computed \"value\", that are not cryptographically bound to a secret originating from the device itself.\n\nThe vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is investigating other potentially affected models.\n\nThe vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.\n \nGovee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Gaining remote control over Govee devices","id":"CVE-2025-10910","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2025"},"n_packages":0,"n_references":1,"next":{"headline":"Libxslt: use-after-free with key data stored cross-rvt","id":"CVE-2025-10911"},"packages":[],"prev":{"headline":"Mangati NovoSGA SVG File admin cross site scripting","id":"CVE-2025-10909"},"products":["H6056"],"published":"2025-12-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-12-19","vendors":["Govee"]},"summary":"Remote attackers can hijack Govee smart devices by exploiting weak device binding, gaining full control and removing legitimate owners.","url":"https://insights.sbomify.com/CVE-2025-10910/"}