VulnerabilityDeferred

CVE-2024-7206

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

HIGH 7.0EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware

CVSS 4.0: 7.0 HIGHCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-295, CWE-798
Source: 68870bb1-d075-4169-957d-e580b18692b9

References

https://ewelink.cc/security-advisory-firmware-extraction-and-hardware-ssl-pinning-bypass/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.