Vulnerability · Published Jul 31, 2024 · Assigned by CoolKit
CVE-2024-7205sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user
Critical 9.4
In plain English
A critical-severity security flaw in eWeLink Cloud Service from CoolKit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.5%top 57.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CoolKit | eWeLink Cloud Service | 2.0.0 – before 2.19.0 |
Weakness: CWE-201 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/R:U/V:D/RE:L/U:Green