# CVE-2025-10910: Gaining remote control over Govee devices

> Remote attackers can hijack Govee smart devices by exploiting weak device binding, gaining full control and removing legitimate owners.

- **Severity:** Critical 9.3 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 18 Dec 2025
- **Updated:** 19 Dec 2025
- **Also known as:** GHSA-7fj8-g5x7-m9v3

## What is CVE-2025-10910?

CVE-2025-10910 is a critical authentication bypass vulnerability in Govee H6056, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account.
The server‑side API allows device association using a set of identifiers: "device", "sku", "type", and a client‑computed "value", that are not cryptographically bound to a secret originating from the device itself.

The vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is investigating other potentially affected models.

The vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate to Device Information section (Firmware Version), and tap the Update button to install the security patch immediately.
 
Govee H6056 devices with hardware versions 1.00.10 or 1.00.11 cannot receive firmware update due to hardware limitations.

Weakness: CWE-639 (Authorization Bypass Through User-Controlled Key)

## Which versions are affected by CVE-2025-10910?


## How do I fix CVE-2025-10910?

No fix has been published for CVE-2025-10910 yet. Limit exposure of the affected software until one is available.

## Is CVE-2025-10910 being exploited?

There is no known exploitation of CVE-2025-10910 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-10910 and fix it if it is affected.

What it is: CVE-2025-10910 is a critical authentication bypass vulnerability in Govee H6056, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-10910 in the wild and no public exploit code.

Affected product: Govee H6056. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-10910/ (Markdown: https://insights.sbomify.com/CVE-2025-10910/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-10910
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-10910
- OSV: https://osv.dev/vulnerability/CVE-2025-10910

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-10910/
Summaries are generated and may contain mistakes; the official description above is the record.